Kernel Log Input Module

Module Name: imklog

Author: Rainer Gerhards <rgerhards@adiscon.com>

Description:

Reads messages from the kernel log and submits them to the syslog engine.

Configuration Directives:

$KLogInternalMsgFacility <facility>
The facility which messages internally generated by imklog will have. imklog generates some messages of itself (e.g. on problems, startup and shutdown) and these do not stem from the kernel. Historically, under Linux, these too have "kern" facility. Thus, on Linux platforms the default is "kern" while on others it is "syslogd". You usually do not need to specify this configuratin directive - it is included primarily for few limited cases where it is needed for good reason. Bottom line: if you don't have a good idea why you should use this setting, do not touch it.
$KLogPermitNonKernelFacility [on/off]
At least under BSD the kernel log may contain entries with non-kernel facilities. This setting controls how those are handled. The default is "off", in which case these messages are ignored. Switch it to on to submit non-kernel messages to rsyslog processing.
$DebugPrintKernelSymbols (imklog) [on/off]
Linux only, ignored on other platforms (but may be specified)
$klogSymbolLookup (imklog) [on/off] -- former klogd -x option
Linux only, ignored on other platforms (but may be specified)
$klogUseSyscallInterface (imklog) [on/off] -- former klogd -2 option
Linux only, ignored on other platforms (but may be specified)
$klogSymbolsTwice (imklog) [on/off] -- former klogd -s option
Linux only, ignored on other platforms (but may be specified)

Caveats/Known Bugs:

This is obviously platform specific and requires platform drivers. Currently, imklog functionality is available on Linux and BSD.

Sample:

The following sample pulls messages from the kernel log. All parameters are left by default, which is usually a good idea. Please note that loading the plugin is sufficient to activate it. No directive is needed to start pulling kernel messages.

[rsyslog.conf overview] [manual index] [rsyslog site]