Examining /dev/log

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
2
down vote

favorite
1












/dev/log is the default entry for system logging. In the case of a sytemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix socket handled by syslog daemon.



~$ echo "hello" > /dev/log 
bash: /dev/log: No such device or address
~$ fuser /dev/log
~$ ls -la /dev/log
lrwxrwxrwx 1 root root 28 Aug 23 07:13 /dev/log -> /run/systemd/journal/dev-log


What is the clarification of the error that pops when you try to write to it and why isn't there a process holding that file (output from fuser /dev/log empty?



The logging does work normally on the system.



~$ logger test
~$ journalctl --since=-1m
-- Logs begin at Thu 2018-05-24 04:23:46 CEST, end at Thu 2018-08-23 13:07:25 CEST. --
Aug 23 13:07:24 alan-N551JM alan[12962]: test


Extending with comment suggestions



~$ sudo fuser /dev/log 
/run/systemd/journal/dev-log: 1 311
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log









share|improve this question























  • @RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
    – TheMeaningfulEngineer
    Aug 23 at 10:58










  • what happens when you run logger "test"? Please add to the question.
    – Rui F Ribeiro
    Aug 23 at 10:59







  • 1




    Please, add to your question the output of sudo fuser /dev/log and ls -lL /dev/log
    – andcoz
    Aug 23 at 11:51










  • @andcoz Bravo, the fuser was a permission issue. Would of have totally missed that due to the silence.
    – TheMeaningfulEngineer
    Aug 23 at 12:02











  • Related: How can I communicate with a Unix domain socket via the shell. You need to use something that uses connect rather than open.
    – Mark Plotnick
    Aug 23 at 19:22















up vote
2
down vote

favorite
1












/dev/log is the default entry for system logging. In the case of a sytemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix socket handled by syslog daemon.



~$ echo "hello" > /dev/log 
bash: /dev/log: No such device or address
~$ fuser /dev/log
~$ ls -la /dev/log
lrwxrwxrwx 1 root root 28 Aug 23 07:13 /dev/log -> /run/systemd/journal/dev-log


What is the clarification of the error that pops when you try to write to it and why isn't there a process holding that file (output from fuser /dev/log empty?



The logging does work normally on the system.



~$ logger test
~$ journalctl --since=-1m
-- Logs begin at Thu 2018-05-24 04:23:46 CEST, end at Thu 2018-08-23 13:07:25 CEST. --
Aug 23 13:07:24 alan-N551JM alan[12962]: test


Extending with comment suggestions



~$ sudo fuser /dev/log 
/run/systemd/journal/dev-log: 1 311
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log









share|improve this question























  • @RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
    – TheMeaningfulEngineer
    Aug 23 at 10:58










  • what happens when you run logger "test"? Please add to the question.
    – Rui F Ribeiro
    Aug 23 at 10:59







  • 1




    Please, add to your question the output of sudo fuser /dev/log and ls -lL /dev/log
    – andcoz
    Aug 23 at 11:51










  • @andcoz Bravo, the fuser was a permission issue. Would of have totally missed that due to the silence.
    – TheMeaningfulEngineer
    Aug 23 at 12:02











  • Related: How can I communicate with a Unix domain socket via the shell. You need to use something that uses connect rather than open.
    – Mark Plotnick
    Aug 23 at 19:22













up vote
2
down vote

favorite
1









up vote
2
down vote

favorite
1






1





/dev/log is the default entry for system logging. In the case of a sytemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix socket handled by syslog daemon.



~$ echo "hello" > /dev/log 
bash: /dev/log: No such device or address
~$ fuser /dev/log
~$ ls -la /dev/log
lrwxrwxrwx 1 root root 28 Aug 23 07:13 /dev/log -> /run/systemd/journal/dev-log


What is the clarification of the error that pops when you try to write to it and why isn't there a process holding that file (output from fuser /dev/log empty?



The logging does work normally on the system.



~$ logger test
~$ journalctl --since=-1m
-- Logs begin at Thu 2018-05-24 04:23:46 CEST, end at Thu 2018-08-23 13:07:25 CEST. --
Aug 23 13:07:24 alan-N551JM alan[12962]: test


Extending with comment suggestions



~$ sudo fuser /dev/log 
/run/systemd/journal/dev-log: 1 311
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log









share|improve this question















/dev/log is the default entry for system logging. In the case of a sytemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix socket handled by syslog daemon.



~$ echo "hello" > /dev/log 
bash: /dev/log: No such device or address
~$ fuser /dev/log
~$ ls -la /dev/log
lrwxrwxrwx 1 root root 28 Aug 23 07:13 /dev/log -> /run/systemd/journal/dev-log


What is the clarification of the error that pops when you try to write to it and why isn't there a process holding that file (output from fuser /dev/log empty?



The logging does work normally on the system.



~$ logger test
~$ journalctl --since=-1m
-- Logs begin at Thu 2018-05-24 04:23:46 CEST, end at Thu 2018-08-23 13:07:25 CEST. --
Aug 23 13:07:24 alan-N551JM alan[12962]: test


Extending with comment suggestions



~$ sudo fuser /dev/log 
/run/systemd/journal/dev-log: 1 311
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log






linux systemd syslog systemd-journald






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Aug 23 at 12:01

























asked Aug 23 at 10:42









TheMeaningfulEngineer

1,56963564




1,56963564











  • @RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
    – TheMeaningfulEngineer
    Aug 23 at 10:58










  • what happens when you run logger "test"? Please add to the question.
    – Rui F Ribeiro
    Aug 23 at 10:59







  • 1




    Please, add to your question the output of sudo fuser /dev/log and ls -lL /dev/log
    – andcoz
    Aug 23 at 11:51










  • @andcoz Bravo, the fuser was a permission issue. Would of have totally missed that due to the silence.
    – TheMeaningfulEngineer
    Aug 23 at 12:02











  • Related: How can I communicate with a Unix domain socket via the shell. You need to use something that uses connect rather than open.
    – Mark Plotnick
    Aug 23 at 19:22

















  • @RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
    – TheMeaningfulEngineer
    Aug 23 at 10:58










  • what happens when you run logger "test"? Please add to the question.
    – Rui F Ribeiro
    Aug 23 at 10:59







  • 1




    Please, add to your question the output of sudo fuser /dev/log and ls -lL /dev/log
    – andcoz
    Aug 23 at 11:51










  • @andcoz Bravo, the fuser was a permission issue. Would of have totally missed that due to the silence.
    – TheMeaningfulEngineer
    Aug 23 at 12:02











  • Related: How can I communicate with a Unix domain socket via the shell. You need to use something that uses connect rather than open.
    – Mark Plotnick
    Aug 23 at 19:22
















@RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
– TheMeaningfulEngineer
Aug 23 at 10:58




@RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
– TheMeaningfulEngineer
Aug 23 at 10:58












what happens when you run logger "test"? Please add to the question.
– Rui F Ribeiro
Aug 23 at 10:59





what happens when you run logger "test"? Please add to the question.
– Rui F Ribeiro
Aug 23 at 10:59





1




1




Please, add to your question the output of sudo fuser /dev/log and ls -lL /dev/log
– andcoz
Aug 23 at 11:51




Please, add to your question the output of sudo fuser /dev/log and ls -lL /dev/log
– andcoz
Aug 23 at 11:51












@andcoz Bravo, the fuser was a permission issue. Would of have totally missed that due to the silence.
– TheMeaningfulEngineer
Aug 23 at 12:02





@andcoz Bravo, the fuser was a permission issue. Would of have totally missed that due to the silence.
– TheMeaningfulEngineer
Aug 23 at 12:02













Related: How can I communicate with a Unix domain socket via the shell. You need to use something that uses connect rather than open.
– Mark Plotnick
Aug 23 at 19:22





Related: How can I communicate with a Unix domain socket via the shell. You need to use something that uses connect rather than open.
– Mark Plotnick
Aug 23 at 19:22











2 Answers
2






active

oldest

votes

















up vote
0
down vote













I am summarizing the comments to a complete answer. Note that @MarkPlotnick was the first to point toward the right solution.



As you can see in ls -lL output, the file pointed by you link is a socket, non a regular file or a pipe.



~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log


Look at the first character of the output. That s means that the file is a socket.



You cannot use the redirection mechanism > of bash (or, AFIK, any other shell) to write in a socket because the shell will try to open the file and open does not support sockets. See man open for details.



You have to use a program that connects to a socket. See man connect for details.



As an example, you can use netcat or socat (see How can I communicate with a Unix domain socket via the shell on Debian Squeeze?).



For sake of completeness, you can use the redirection on pipes.



~$ mkfifo /tmp/fifo
~$ ls -l /tmp/fifo
prw-rw-rw- 1 root root 0 27 ago 15.04 /tmp/fifo
~$ echo "hello" > /tmp/fifo


Look at the first character of the ls output. That p means that the file is a pipe.






share|improve this answer




















  • Please also extend with your answer on why no processes were detected having a handle on the socked.
    – TheMeaningfulEngineer
    Aug 28 at 10:24

















up vote
-2
down vote













You should verify /run/systemd/journal/dev-log, its permissions and who's using it. You were checking a link.






share|improve this answer




















  • That doesn't influence the results in any way. I mention it as being a link also in the question.
    – TheMeaningfulEngineer
    Aug 23 at 10:49











  • That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
    – Gerard H. Pille
    Aug 23 at 11:08










  • I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
    – Gerard H. Pille
    Aug 23 at 11:16










  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
    – Jeff Schaller
    Aug 23 at 12:17










  • @JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
    – Gerard H. Pille
    Aug 23 at 13:10










Your Answer







StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













 

draft saved


draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f464361%2fexamining-dev-log%23new-answer', 'question_page');

);

Post as a guest






























2 Answers
2






active

oldest

votes








2 Answers
2






active

oldest

votes









active

oldest

votes






active

oldest

votes








up vote
0
down vote













I am summarizing the comments to a complete answer. Note that @MarkPlotnick was the first to point toward the right solution.



As you can see in ls -lL output, the file pointed by you link is a socket, non a regular file or a pipe.



~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log


Look at the first character of the output. That s means that the file is a socket.



You cannot use the redirection mechanism > of bash (or, AFIK, any other shell) to write in a socket because the shell will try to open the file and open does not support sockets. See man open for details.



You have to use a program that connects to a socket. See man connect for details.



As an example, you can use netcat or socat (see How can I communicate with a Unix domain socket via the shell on Debian Squeeze?).



For sake of completeness, you can use the redirection on pipes.



~$ mkfifo /tmp/fifo
~$ ls -l /tmp/fifo
prw-rw-rw- 1 root root 0 27 ago 15.04 /tmp/fifo
~$ echo "hello" > /tmp/fifo


Look at the first character of the ls output. That p means that the file is a pipe.






share|improve this answer




















  • Please also extend with your answer on why no processes were detected having a handle on the socked.
    – TheMeaningfulEngineer
    Aug 28 at 10:24














up vote
0
down vote













I am summarizing the comments to a complete answer. Note that @MarkPlotnick was the first to point toward the right solution.



As you can see in ls -lL output, the file pointed by you link is a socket, non a regular file or a pipe.



~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log


Look at the first character of the output. That s means that the file is a socket.



You cannot use the redirection mechanism > of bash (or, AFIK, any other shell) to write in a socket because the shell will try to open the file and open does not support sockets. See man open for details.



You have to use a program that connects to a socket. See man connect for details.



As an example, you can use netcat or socat (see How can I communicate with a Unix domain socket via the shell on Debian Squeeze?).



For sake of completeness, you can use the redirection on pipes.



~$ mkfifo /tmp/fifo
~$ ls -l /tmp/fifo
prw-rw-rw- 1 root root 0 27 ago 15.04 /tmp/fifo
~$ echo "hello" > /tmp/fifo


Look at the first character of the ls output. That p means that the file is a pipe.






share|improve this answer




















  • Please also extend with your answer on why no processes were detected having a handle on the socked.
    – TheMeaningfulEngineer
    Aug 28 at 10:24












up vote
0
down vote










up vote
0
down vote









I am summarizing the comments to a complete answer. Note that @MarkPlotnick was the first to point toward the right solution.



As you can see in ls -lL output, the file pointed by you link is a socket, non a regular file or a pipe.



~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log


Look at the first character of the output. That s means that the file is a socket.



You cannot use the redirection mechanism > of bash (or, AFIK, any other shell) to write in a socket because the shell will try to open the file and open does not support sockets. See man open for details.



You have to use a program that connects to a socket. See man connect for details.



As an example, you can use netcat or socat (see How can I communicate with a Unix domain socket via the shell on Debian Squeeze?).



For sake of completeness, you can use the redirection on pipes.



~$ mkfifo /tmp/fifo
~$ ls -l /tmp/fifo
prw-rw-rw- 1 root root 0 27 ago 15.04 /tmp/fifo
~$ echo "hello" > /tmp/fifo


Look at the first character of the ls output. That p means that the file is a pipe.






share|improve this answer












I am summarizing the comments to a complete answer. Note that @MarkPlotnick was the first to point toward the right solution.



As you can see in ls -lL output, the file pointed by you link is a socket, non a regular file or a pipe.



~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log


Look at the first character of the output. That s means that the file is a socket.



You cannot use the redirection mechanism > of bash (or, AFIK, any other shell) to write in a socket because the shell will try to open the file and open does not support sockets. See man open for details.



You have to use a program that connects to a socket. See man connect for details.



As an example, you can use netcat or socat (see How can I communicate with a Unix domain socket via the shell on Debian Squeeze?).



For sake of completeness, you can use the redirection on pipes.



~$ mkfifo /tmp/fifo
~$ ls -l /tmp/fifo
prw-rw-rw- 1 root root 0 27 ago 15.04 /tmp/fifo
~$ echo "hello" > /tmp/fifo


Look at the first character of the ls output. That p means that the file is a pipe.







share|improve this answer












share|improve this answer



share|improve this answer










answered Aug 27 at 13:18









andcoz

11.9k32938




11.9k32938











  • Please also extend with your answer on why no processes were detected having a handle on the socked.
    – TheMeaningfulEngineer
    Aug 28 at 10:24
















  • Please also extend with your answer on why no processes were detected having a handle on the socked.
    – TheMeaningfulEngineer
    Aug 28 at 10:24















Please also extend with your answer on why no processes were detected having a handle on the socked.
– TheMeaningfulEngineer
Aug 28 at 10:24




Please also extend with your answer on why no processes were detected having a handle on the socked.
– TheMeaningfulEngineer
Aug 28 at 10:24












up vote
-2
down vote













You should verify /run/systemd/journal/dev-log, its permissions and who's using it. You were checking a link.






share|improve this answer




















  • That doesn't influence the results in any way. I mention it as being a link also in the question.
    – TheMeaningfulEngineer
    Aug 23 at 10:49











  • That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
    – Gerard H. Pille
    Aug 23 at 11:08










  • I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
    – Gerard H. Pille
    Aug 23 at 11:16










  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
    – Jeff Schaller
    Aug 23 at 12:17










  • @JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
    – Gerard H. Pille
    Aug 23 at 13:10














up vote
-2
down vote













You should verify /run/systemd/journal/dev-log, its permissions and who's using it. You were checking a link.






share|improve this answer




















  • That doesn't influence the results in any way. I mention it as being a link also in the question.
    – TheMeaningfulEngineer
    Aug 23 at 10:49











  • That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
    – Gerard H. Pille
    Aug 23 at 11:08










  • I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
    – Gerard H. Pille
    Aug 23 at 11:16










  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
    – Jeff Schaller
    Aug 23 at 12:17










  • @JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
    – Gerard H. Pille
    Aug 23 at 13:10












up vote
-2
down vote










up vote
-2
down vote









You should verify /run/systemd/journal/dev-log, its permissions and who's using it. You were checking a link.






share|improve this answer












You should verify /run/systemd/journal/dev-log, its permissions and who's using it. You were checking a link.







share|improve this answer












share|improve this answer



share|improve this answer










answered Aug 23 at 10:46









Gerard H. Pille

1,304212




1,304212











  • That doesn't influence the results in any way. I mention it as being a link also in the question.
    – TheMeaningfulEngineer
    Aug 23 at 10:49











  • That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
    – Gerard H. Pille
    Aug 23 at 11:08










  • I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
    – Gerard H. Pille
    Aug 23 at 11:16










  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
    – Jeff Schaller
    Aug 23 at 12:17










  • @JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
    – Gerard H. Pille
    Aug 23 at 13:10
















  • That doesn't influence the results in any way. I mention it as being a link also in the question.
    – TheMeaningfulEngineer
    Aug 23 at 10:49











  • That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
    – Gerard H. Pille
    Aug 23 at 11:08










  • I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
    – Gerard H. Pille
    Aug 23 at 11:16










  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
    – Jeff Schaller
    Aug 23 at 12:17










  • @JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
    – Gerard H. Pille
    Aug 23 at 13:10















That doesn't influence the results in any way. I mention it as being a link also in the question.
– TheMeaningfulEngineer
Aug 23 at 10:49





That doesn't influence the results in any way. I mention it as being a link also in the question.
– TheMeaningfulEngineer
Aug 23 at 10:49













That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
– Gerard H. Pille
Aug 23 at 11:08




That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
– Gerard H. Pille
Aug 23 at 11:08












I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
– Gerard H. Pille
Aug 23 at 11:16




I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
– Gerard H. Pille
Aug 23 at 11:16












This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
– Jeff Schaller
Aug 23 at 12:17




This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
– Jeff Schaller
Aug 23 at 12:17












@JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
– Gerard H. Pille
Aug 23 at 13:10




@JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
– Gerard H. Pille
Aug 23 at 13:10

















 

draft saved


draft discarded















































 


draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f464361%2fexamining-dev-log%23new-answer', 'question_page');

);

Post as a guest













































































Popular posts from this blog

Peggy Mitchell

Palaiologos

The Forum (Inglewood, California)