Kernel messages

[Trevor]

Where does the kernel store log messages when a Linux system boots?

[Chetan_Tiwary_ · Accepted solution]

kernel ring buffer  --------------------- which is a circular data structure with a predefined, fixed size that is built directly into the kernel's code.

One can view the information currently held within this buffer by using the dmesg or journalctl command or by examining the /var/log/boot.log file.

Do note that the ring buffer operates cyclically; when it reaches its capacity, any new incoming data will overwrite the oldest existing data.

This buffer acts as a temporary storage for those important boot related  messages which are then saved permanently using syslog services to use with commands like dmesg and journalctl.

[Chetan_Tiwary_ · Accepted solution]

another important thing : kernel printk() function within the kernel code collect all logs of various levels / severity :

Each of these values defines a different rule for handling error messages.

7 : Kernel debug-level messages.

4: General kernel warning condition

1: Kernel alert. Action must be taken immediately.

[Trevor]

Superb!  Crystal clear!!!

[Trevor]

So wonderful to know abou this /var/log/boot.log file option!!

Chetan, got a question regarding that last sentence, where you refer to messages being "saved permanently using syslog services": May I get you to expound on "syslog services". 
Right now I'm associating that with the rsyslog daemon, because I believe rsyslogd is a syslog service.   

Thank you for that initial reply!!!

[Chetan_Tiwary_]

@Trevor You are right in associating rsyslogd with syslog service. 

System log services are the parts of the operating system that take on the job of gathering, handling, keeping, and sending along log messages produced by everything from the kernel and applications to other system processes. These services make sure that all this log information is managed in an organized way, which allows administrators to easily check what's happening, figure out problems, and review system activity.

The term "syslog" denotes a standardized approach to message formatting and has evolved into the conventional system logging solution for Unix-like operating systems. Simultaneously, "syslog" can refer to:

A general concept encompassing system logging, with specific implementations such as:

syslogd: The initial service to provide syslog functionality in Unix-based systems.
sysklogd: A Unix service responsible for receiving and forwarding log messages.
syslog-ng
rsyslog : Rsyslog stands as an open-source, high-throughput system designed for processing logs. Going beyond the capabilities of a standard system logger, it functions as a flexible utility capable of receiving input from diverse origins and directing output to numerous destinations.

Rsyslog includes support for transmitting log messages across IP networks, to databases, via email, and more. Furthermore, it enhances the fundamental syslog protocol with robust filtering functionalities. Its extensive configuration settings allow for adaptation to meet particular requirements.

So in a nutshell :  rsyslogd (and other syslog services) act as the bridge between the transient in-memory kernel ring buffer and the permanent storage of log files, ensuring that important boot-time information is preserved for later review and troubleshooting.

[Trevor]

Chetan, thank you for another marvelous lesson!!!

This is an exemplary condensed explanation!!!