lkrg-org / lkrg

Linux Kernel Runtime Guard
https://lkrg.org
Other
402 stars 72 forks source link

stdout piping #247

Closed 12D687 closed 1 year ago

12D687 commented 1 year ago

I wonder If there is any possibility to pipe the lkrg output for custom logfile. Because it's cumbersome and unreliable for reading kernel buffer using dmesg.

solardiz commented 1 year ago

Instead of using the dmesg command, you can use one of the underlying kernel interfaces, which are:

  1. /dev/kmsg. If you do a SEEK_END on it, you'll only be reading newly appearing messages. Such reads don't affect other readers from that pseudo-file.
  2. /proc/kmsg. Reads do affect other readers (whatever has been read disappears for all readers).
  3. Various sub-calls of syslog(2).

I recommend the first option.

Does this address your question/need?

solardiz commented 1 year ago

Also, how custom does your log file need to be? Most distros either readily direct kernel messages to a separate log file or use systemd journal, in which case journalctl -k (you can also add -f) will show you kernel messages only.

So you can do e.g.:

journalctl -kf --lines=0 | fgrep --line-buffered ' kernel: LKRG: ' > new-lkrg-messages
solardiz commented 1 year ago

Not an issue we need to track, so I'm closing, but please feel free to add further comments anyway.