[systemd-devel] syslogs in /proc/kmsg

[Albert Strasheim]

Hello all

I have a question about systemd and syslog and application logs ending
up in kmsg (as outputted by dmesg).

My system.conf contains:

[Manager]
LogTarget=syslog
DefaultStandardOutput=syslog
DefaultStandardError=syslog

and all my services have:

StandardOutput=syslog
StandardError=inherit

multi-user.target.wants contains rsyslog.service and smartd.service,
amongst others. My smartd configuration produces a lot of log output.

The first smartd output goes into /proc/kmsg as reported by running dmesg:

[   32.484767] smartd[1279]: smartd 5.41 2011-06-09 r3365
[x86_64-linux-3.1.0-0.rc3.git0.0.fc16.x86_64] (local build)
[   32.495808] smartd[1279]: Copyright (C) 2002-11 by Bruce Allen,
http://smartmontools.sourceforge.net

Then rsyslog starts up and takes over from
systemd-kmsg-syslogd.service, thus output starts going to
/var/log/messages:

Sep  4 21:48:31 foo kernel: imklog 5.8.2, log source = /proc/kmsg started.
Sep  4 21:48:31 foo rsyslogd: [origin software="rsyslogd"
swVersion="5.8.2" x-pid="1850" x-info="http://www.rsyslog.com"] start
Sep  4 21:48:31 foo smartd[1279]: Device: /dev/sg20, is SMART capable.
Adding to "monitor" list.

It seems rsyslog also processes the kernel messages in /proc/kmsg,
because /var/log/messages also contains:

Sep  4 21:48:31 foo kernel: :80:16.5: reg 10: [mem 0xf7fe4000-0xf7fe7fff 64bit]
Sep  4 21:48:31 foo kernel: [    5.564833] pci 0000:80:00.0: PCI
bridge to [bus 81-81]
Sep  4 21:48:31 foo kernel: [    5.570385] pci 0000:80:01.0: PCI
bridge to [bus 82-82]

However, it seems the very first messages from the kernel are
truncated, because the application logs are overflowing the ring
buffer.

Also, it doesn't seem as if the first application logs end up
/var/log/messages though.

Should I be seeing these first application logs in /var/log/messages?

Also, is there any way to avoid the application logs in /proc/kmsg (to
avoid the overflow)? I guess I could add After=rsyslog.service to all
my services, but that doesn't seem right.

I'm using

systemd-34-1.fc16.x86_64
rsyslog-5.8.2-3.fc16.x86_64

rsyslog configuration is the default as shipped with F16.

Regards,

Albert