[systemd-devel] syslogs in /proc/kmsg

Albert Strasheim fullung at gmail.com
Mon Sep 5 03:25:33 PDT 2011

Hello all

I have a question about systemd and syslog and application logs ending
up in kmsg (as outputted by dmesg).

My system.conf contains:


and all my services have:


multi-user.target.wants contains rsyslog.service and smartd.service,
amongst others. My smartd configuration produces a lot of log output.

The first smartd output goes into /proc/kmsg as reported by running dmesg:

[   32.484767] smartd[1279]: smartd 5.41 2011-06-09 r3365
[x86_64-linux-3.1.0-0.rc3.git0.0.fc16.x86_64] (local build)
[   32.495808] smartd[1279]: Copyright (C) 2002-11 by Bruce Allen,

Then rsyslog starts up and takes over from
systemd-kmsg-syslogd.service, thus output starts going to

Sep  4 21:48:31 foo kernel: imklog 5.8.2, log source = /proc/kmsg started.
Sep  4 21:48:31 foo rsyslogd: [origin software="rsyslogd"
swVersion="5.8.2" x-pid="1850" x-info="http://www.rsyslog.com"] start
Sep  4 21:48:31 foo smartd[1279]: Device: /dev/sg20, is SMART capable.
Adding to "monitor" list.

It seems rsyslog also processes the kernel messages in /proc/kmsg,
because /var/log/messages also contains:

Sep  4 21:48:31 foo kernel: :80:16.5: reg 10: [mem 0xf7fe4000-0xf7fe7fff 64bit]
Sep  4 21:48:31 foo kernel: [    5.564833] pci 0000:80:00.0: PCI
bridge to [bus 81-81]
Sep  4 21:48:31 foo kernel: [    5.570385] pci 0000:80:01.0: PCI
bridge to [bus 82-82]

However, it seems the very first messages from the kernel are
truncated, because the application logs are overflowing the ring

Also, it doesn't seem as if the first application logs end up
/var/log/messages though.

Should I be seeing these first application logs in /var/log/messages?

Also, is there any way to avoid the application logs in /proc/kmsg (to
avoid the overflow)? I guess I could add After=rsyslog.service to all
my services, but that doesn't seem right.

I'm using


rsyslog configuration is the default as shipped with F16.



More information about the systemd-devel mailing list