bind() to /dev/log failed

Bryn M. Reeves bmr at
Fri Jul 23 13:27:00 UTC 2010

On 07/23/2010 05:14 AM, Mansuri, Wasim (NSN - IN/Bangalore) wrote:
> I am working on some network server which has to monitor the os
> events and report it to some GUI. For that I want to read the
> /dev/log and process it and report it to the GUI.
> So here my aim is not to write but I want to read the messages coming
> to /dev/log. I made some changes in the code which I pasted in my
> first post. And found out working with some limitation. My program
> has to come up before the syslogd comes up. And second is once I bind
> and start reading syslogd is not able to read anything with which I
> can not live with.
> Now I want to know, Is there any possiblity that My program and
> syslogd both can listen and read the messages? I mean once I or
> syslogd reads message buffre for /dev/log does not emptied. I don't
> want to consume message from the /dev/log, I just want to read it.
> If I summerise my question than, Is there any possibility to read the
> datagram socket whithout consuming data from the socket? I want to
> keep the data for other applications to read.

Not really I don't think. Even if you were able to snoop at the buffers
with e.g. recvmsg and the MSG_PEEK flag (man 2 recv) I don't see a way
of knowing that syslogd wasn't consuming things behind your back causing
your application to appear to lose messages.

Wouldn't it be easier to require some configuration for your app? E.g.
have the system syslog daemon configured to pick messages up from
/dev/log as normal and deliver them via tcp/udp using regular network
syslog messages to a port on which your app is listening?

Very straightforward to set up and would work with any RFC-compliant
syslog implementation.


More information about the users mailing list