Examining /dev/log

Clash Royale CLAN TAG#URR8PPP
up vote
2
down vote
favorite
/dev/log is the default entry for system logging. In the case of a sytemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix socket handled by syslog daemon.
~$ echo "hello" > /dev/log
bash: /dev/log: No such device or address
~$ fuser /dev/log
~$ ls -la /dev/log
lrwxrwxrwx 1 root root 28 Aug 23 07:13 /dev/log -> /run/systemd/journal/dev-log
What is the clarification of the error that pops when you try to write to it and why isn't there a process holding that file (output from fuser /dev/log empty?
The logging does work normally on the system.
~$ logger test
~$ journalctl --since=-1m
-- Logs begin at Thu 2018-05-24 04:23:46 CEST, end at Thu 2018-08-23 13:07:25 CEST. --
Aug 23 13:07:24 alan-N551JM alan[12962]: test
Extending with comment suggestions
~$ sudo fuser /dev/log
/run/systemd/journal/dev-log: 1 311
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log
linux systemd syslog systemd-journald
 |Â
show 5 more comments
up vote
2
down vote
favorite
/dev/log is the default entry for system logging. In the case of a sytemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix socket handled by syslog daemon.
~$ echo "hello" > /dev/log
bash: /dev/log: No such device or address
~$ fuser /dev/log
~$ ls -la /dev/log
lrwxrwxrwx 1 root root 28 Aug 23 07:13 /dev/log -> /run/systemd/journal/dev-log
What is the clarification of the error that pops when you try to write to it and why isn't there a process holding that file (output from fuser /dev/log empty?
The logging does work normally on the system.
~$ logger test
~$ journalctl --since=-1m
-- Logs begin at Thu 2018-05-24 04:23:46 CEST, end at Thu 2018-08-23 13:07:25 CEST. --
Aug 23 13:07:24 alan-N551JM alan[12962]: test
Extending with comment suggestions
~$ sudo fuser /dev/log
/run/systemd/journal/dev-log: 1 311
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log
linux systemd syslog systemd-journald
@RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
â TheMeaningfulEngineer
Aug 23 at 10:58
what happens when you runlogger "test"? Please add to the question.
â Rui F Ribeiro
Aug 23 at 10:59
1
Please, add to your question the output ofsudo fuser /dev/logandls -lL /dev/log
â andcoz
Aug 23 at 11:51
@andcoz Bravo, thefuserwas a permission issue. Would of have totally missed that due to the silence.
â TheMeaningfulEngineer
Aug 23 at 12:02
Related: How can I communicate with a Unix domain socket via the shell. You need to use something that usesconnectrather thanopen.
â Mark Plotnick
Aug 23 at 19:22
 |Â
show 5 more comments
up vote
2
down vote
favorite
up vote
2
down vote
favorite
/dev/log is the default entry for system logging. In the case of a sytemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix socket handled by syslog daemon.
~$ echo "hello" > /dev/log
bash: /dev/log: No such device or address
~$ fuser /dev/log
~$ ls -la /dev/log
lrwxrwxrwx 1 root root 28 Aug 23 07:13 /dev/log -> /run/systemd/journal/dev-log
What is the clarification of the error that pops when you try to write to it and why isn't there a process holding that file (output from fuser /dev/log empty?
The logging does work normally on the system.
~$ logger test
~$ journalctl --since=-1m
-- Logs begin at Thu 2018-05-24 04:23:46 CEST, end at Thu 2018-08-23 13:07:25 CEST. --
Aug 23 13:07:24 alan-N551JM alan[12962]: test
Extending with comment suggestions
~$ sudo fuser /dev/log
/run/systemd/journal/dev-log: 1 311
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log
linux systemd syslog systemd-journald
/dev/log is the default entry for system logging. In the case of a sytemd implementation (this case) it's a symlink to whatever /run/systemd/journal/dev-log. It used to be a receiving end of a unix socket handled by syslog daemon.
~$ echo "hello" > /dev/log
bash: /dev/log: No such device or address
~$ fuser /dev/log
~$ ls -la /dev/log
lrwxrwxrwx 1 root root 28 Aug 23 07:13 /dev/log -> /run/systemd/journal/dev-log
What is the clarification of the error that pops when you try to write to it and why isn't there a process holding that file (output from fuser /dev/log empty?
The logging does work normally on the system.
~$ logger test
~$ journalctl --since=-1m
-- Logs begin at Thu 2018-05-24 04:23:46 CEST, end at Thu 2018-08-23 13:07:25 CEST. --
Aug 23 13:07:24 alan-N551JM alan[12962]: test
Extending with comment suggestions
~$ sudo fuser /dev/log
/run/systemd/journal/dev-log: 1 311
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log
linux systemd syslog systemd-journald
linux systemd syslog systemd-journald
edited Aug 23 at 12:01
asked Aug 23 at 10:42
TheMeaningfulEngineer
1,56963564
1,56963564
@RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
â TheMeaningfulEngineer
Aug 23 at 10:58
what happens when you runlogger "test"? Please add to the question.
â Rui F Ribeiro
Aug 23 at 10:59
1
Please, add to your question the output ofsudo fuser /dev/logandls -lL /dev/log
â andcoz
Aug 23 at 11:51
@andcoz Bravo, thefuserwas a permission issue. Would of have totally missed that due to the silence.
â TheMeaningfulEngineer
Aug 23 at 12:02
Related: How can I communicate with a Unix domain socket via the shell. You need to use something that usesconnectrather thanopen.
â Mark Plotnick
Aug 23 at 19:22
 |Â
show 5 more comments
@RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
â TheMeaningfulEngineer
Aug 23 at 10:58
what happens when you runlogger "test"? Please add to the question.
â Rui F Ribeiro
Aug 23 at 10:59
1
Please, add to your question the output ofsudo fuser /dev/logandls -lL /dev/log
â andcoz
Aug 23 at 11:51
@andcoz Bravo, thefuserwas a permission issue. Would of have totally missed that due to the silence.
â TheMeaningfulEngineer
Aug 23 at 12:02
Related: How can I communicate with a Unix domain socket via the shell. You need to use something that usesconnectrather thanopen.
â Mark Plotnick
Aug 23 at 19:22
@RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
â TheMeaningfulEngineer
Aug 23 at 10:58
@RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
â TheMeaningfulEngineer
Aug 23 at 10:58
what happens when you run
logger "test"? Please add to the question.â Rui F Ribeiro
Aug 23 at 10:59
what happens when you run
logger "test"? Please add to the question.â Rui F Ribeiro
Aug 23 at 10:59
1
1
Please, add to your question the output of
sudo fuser /dev/log and ls -lL /dev/logâ andcoz
Aug 23 at 11:51
Please, add to your question the output of
sudo fuser /dev/log and ls -lL /dev/logâ andcoz
Aug 23 at 11:51
@andcoz Bravo, the
fuser was a permission issue. Would of have totally missed that due to the silence.â TheMeaningfulEngineer
Aug 23 at 12:02
@andcoz Bravo, the
fuser was a permission issue. Would of have totally missed that due to the silence.â TheMeaningfulEngineer
Aug 23 at 12:02
Related: How can I communicate with a Unix domain socket via the shell. You need to use something that uses
connect rather than open.â Mark Plotnick
Aug 23 at 19:22
Related: How can I communicate with a Unix domain socket via the shell. You need to use something that uses
connect rather than open.â Mark Plotnick
Aug 23 at 19:22
 |Â
show 5 more comments
2 Answers
2
active
oldest
votes
up vote
0
down vote
I am summarizing the comments to a complete answer. Note that @MarkPlotnick was the first to point toward the right solution.
As you can see in ls -lL output, the file pointed by you link is a socket, non a regular file or a pipe.
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log
Look at the first character of the output. That s means that the file is a socket.
You cannot use the redirection mechanism > of bash (or, AFIK, any other shell) to write in a socket because the shell will try to open the file and open does not support sockets. See man open for details.
You have to use a program that connects to a socket. See man connect for details.
As an example, you can use netcat or socat (see How can I communicate with a Unix domain socket via the shell on Debian Squeeze?).
For sake of completeness, you can use the redirection on pipes.
~$ mkfifo /tmp/fifo
~$ ls -l /tmp/fifo
prw-rw-rw- 1 root root 0 27 ago 15.04 /tmp/fifo
~$ echo "hello" > /tmp/fifo
Look at the first character of the ls output. That p means that the file is a pipe.
Please also extend with your answer on why no processes were detected having a handle on the socked.
â TheMeaningfulEngineer
Aug 28 at 10:24
add a comment |Â
up vote
-2
down vote
You should verify /run/systemd/journal/dev-log, its permissions and who's using it. You were checking a link.
That doesn't influence the results in any way. I mention it as being a link also in the question.
â TheMeaningfulEngineer
Aug 23 at 10:49
That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
â Gerard H. Pille
Aug 23 at 11:08
I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
â Gerard H. Pille
Aug 23 at 11:16
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
â Jeff Schaller
Aug 23 at 12:17
@JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
â Gerard H. Pille
Aug 23 at 13:10
 |Â
show 2 more comments
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
I am summarizing the comments to a complete answer. Note that @MarkPlotnick was the first to point toward the right solution.
As you can see in ls -lL output, the file pointed by you link is a socket, non a regular file or a pipe.
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log
Look at the first character of the output. That s means that the file is a socket.
You cannot use the redirection mechanism > of bash (or, AFIK, any other shell) to write in a socket because the shell will try to open the file and open does not support sockets. See man open for details.
You have to use a program that connects to a socket. See man connect for details.
As an example, you can use netcat or socat (see How can I communicate with a Unix domain socket via the shell on Debian Squeeze?).
For sake of completeness, you can use the redirection on pipes.
~$ mkfifo /tmp/fifo
~$ ls -l /tmp/fifo
prw-rw-rw- 1 root root 0 27 ago 15.04 /tmp/fifo
~$ echo "hello" > /tmp/fifo
Look at the first character of the ls output. That p means that the file is a pipe.
Please also extend with your answer on why no processes were detected having a handle on the socked.
â TheMeaningfulEngineer
Aug 28 at 10:24
add a comment |Â
up vote
0
down vote
I am summarizing the comments to a complete answer. Note that @MarkPlotnick was the first to point toward the right solution.
As you can see in ls -lL output, the file pointed by you link is a socket, non a regular file or a pipe.
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log
Look at the first character of the output. That s means that the file is a socket.
You cannot use the redirection mechanism > of bash (or, AFIK, any other shell) to write in a socket because the shell will try to open the file and open does not support sockets. See man open for details.
You have to use a program that connects to a socket. See man connect for details.
As an example, you can use netcat or socat (see How can I communicate with a Unix domain socket via the shell on Debian Squeeze?).
For sake of completeness, you can use the redirection on pipes.
~$ mkfifo /tmp/fifo
~$ ls -l /tmp/fifo
prw-rw-rw- 1 root root 0 27 ago 15.04 /tmp/fifo
~$ echo "hello" > /tmp/fifo
Look at the first character of the ls output. That p means that the file is a pipe.
Please also extend with your answer on why no processes were detected having a handle on the socked.
â TheMeaningfulEngineer
Aug 28 at 10:24
add a comment |Â
up vote
0
down vote
up vote
0
down vote
I am summarizing the comments to a complete answer. Note that @MarkPlotnick was the first to point toward the right solution.
As you can see in ls -lL output, the file pointed by you link is a socket, non a regular file or a pipe.
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log
Look at the first character of the output. That s means that the file is a socket.
You cannot use the redirection mechanism > of bash (or, AFIK, any other shell) to write in a socket because the shell will try to open the file and open does not support sockets. See man open for details.
You have to use a program that connects to a socket. See man connect for details.
As an example, you can use netcat or socat (see How can I communicate with a Unix domain socket via the shell on Debian Squeeze?).
For sake of completeness, you can use the redirection on pipes.
~$ mkfifo /tmp/fifo
~$ ls -l /tmp/fifo
prw-rw-rw- 1 root root 0 27 ago 15.04 /tmp/fifo
~$ echo "hello" > /tmp/fifo
Look at the first character of the ls output. That p means that the file is a pipe.
I am summarizing the comments to a complete answer. Note that @MarkPlotnick was the first to point toward the right solution.
As you can see in ls -lL output, the file pointed by you link is a socket, non a regular file or a pipe.
~$ ls -lL /dev/log
srw-rw-rw- 1 root root 0 Aug 23 07:13 /dev/log
Look at the first character of the output. That s means that the file is a socket.
You cannot use the redirection mechanism > of bash (or, AFIK, any other shell) to write in a socket because the shell will try to open the file and open does not support sockets. See man open for details.
You have to use a program that connects to a socket. See man connect for details.
As an example, you can use netcat or socat (see How can I communicate with a Unix domain socket via the shell on Debian Squeeze?).
For sake of completeness, you can use the redirection on pipes.
~$ mkfifo /tmp/fifo
~$ ls -l /tmp/fifo
prw-rw-rw- 1 root root 0 27 ago 15.04 /tmp/fifo
~$ echo "hello" > /tmp/fifo
Look at the first character of the ls output. That p means that the file is a pipe.
answered Aug 27 at 13:18
andcoz
11.9k32938
11.9k32938
Please also extend with your answer on why no processes were detected having a handle on the socked.
â TheMeaningfulEngineer
Aug 28 at 10:24
add a comment |Â
Please also extend with your answer on why no processes were detected having a handle on the socked.
â TheMeaningfulEngineer
Aug 28 at 10:24
Please also extend with your answer on why no processes were detected having a handle on the socked.
â TheMeaningfulEngineer
Aug 28 at 10:24
Please also extend with your answer on why no processes were detected having a handle on the socked.
â TheMeaningfulEngineer
Aug 28 at 10:24
add a comment |Â
up vote
-2
down vote
You should verify /run/systemd/journal/dev-log, its permissions and who's using it. You were checking a link.
That doesn't influence the results in any way. I mention it as being a link also in the question.
â TheMeaningfulEngineer
Aug 23 at 10:49
That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
â Gerard H. Pille
Aug 23 at 11:08
I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
â Gerard H. Pille
Aug 23 at 11:16
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
â Jeff Schaller
Aug 23 at 12:17
@JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
â Gerard H. Pille
Aug 23 at 13:10
 |Â
show 2 more comments
up vote
-2
down vote
You should verify /run/systemd/journal/dev-log, its permissions and who's using it. You were checking a link.
That doesn't influence the results in any way. I mention it as being a link also in the question.
â TheMeaningfulEngineer
Aug 23 at 10:49
That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
â Gerard H. Pille
Aug 23 at 11:08
I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
â Gerard H. Pille
Aug 23 at 11:16
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
â Jeff Schaller
Aug 23 at 12:17
@JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
â Gerard H. Pille
Aug 23 at 13:10
 |Â
show 2 more comments
up vote
-2
down vote
up vote
-2
down vote
You should verify /run/systemd/journal/dev-log, its permissions and who's using it. You were checking a link.
You should verify /run/systemd/journal/dev-log, its permissions and who's using it. You were checking a link.
answered Aug 23 at 10:46
Gerard H. Pille
1,304212
1,304212
That doesn't influence the results in any way. I mention it as being a link also in the question.
â TheMeaningfulEngineer
Aug 23 at 10:49
That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
â Gerard H. Pille
Aug 23 at 11:08
I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
â Gerard H. Pille
Aug 23 at 11:16
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
â Jeff Schaller
Aug 23 at 12:17
@JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
â Gerard H. Pille
Aug 23 at 13:10
 |Â
show 2 more comments
That doesn't influence the results in any way. I mention it as being a link also in the question.
â TheMeaningfulEngineer
Aug 23 at 10:49
That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
â Gerard H. Pille
Aug 23 at 11:08
I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
â Gerard H. Pille
Aug 23 at 11:16
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
â Jeff Schaller
Aug 23 at 12:17
@JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
â Gerard H. Pille
Aug 23 at 13:10
That doesn't influence the results in any way. I mention it as being a link also in the question.
â TheMeaningfulEngineer
Aug 23 at 10:49
That doesn't influence the results in any way. I mention it as being a link also in the question.
â TheMeaningfulEngineer
Aug 23 at 10:49
That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
â Gerard H. Pille
Aug 23 at 11:08
That's strange. It would be interesting to know your distro. On CentOS 7, /dev/log is a socket, used by the /usr/lib/systemd/systemd-journald process.
â Gerard H. Pille
Aug 23 at 11:08
I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
â Gerard H. Pille
Aug 23 at 11:16
I find it hard to believe that "fuser /run/systemd/journal/dev-log" would show nothing.
â Gerard H. Pille
Aug 23 at 11:16
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
â Jeff Schaller
Aug 23 at 12:17
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
â Jeff Schaller
Aug 23 at 12:17
@JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
â Gerard H. Pille
Aug 23 at 13:10
@JeffSchaller Better have a look at the edited question. You'll find I did provide the answer.
â Gerard H. Pille
Aug 23 at 13:10
 |Â
show 2 more comments
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f464361%2fexamining-dev-log%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
@RuiFRibeiro Updated to make it clearer that the examples are from a systemd implementation.
â TheMeaningfulEngineer
Aug 23 at 10:58
what happens when you run
logger "test"? Please add to the question.â Rui F Ribeiro
Aug 23 at 10:59
1
Please, add to your question the output of
sudo fuser /dev/logandls -lL /dev/logâ andcoz
Aug 23 at 11:51
@andcoz Bravo, the
fuserwas a permission issue. Would of have totally missed that due to the silence.â TheMeaningfulEngineer
Aug 23 at 12:02
Related: How can I communicate with a Unix domain socket via the shell. You need to use something that uses
connectrather thanopen.â Mark Plotnick
Aug 23 at 19:22