转载于：https://blog.csdn.net/C_Major/article/details/51321684
1 内核编程insmod后，Ubuntu查看日志无/var/log/messages
写好简单内核模块如hellomod.ko后，执行命令 insmod hellomod.ko 后，查看内核打印的printk信息， tail /var/log/messages 后发现并没有messages文件。
2 Ubuntu是有/var/log/messages这个文件的！
root@XXX:/home/river# vim /etc/rsyslog.d/50-default.conf
找到
# 33 # Some "catch-all" log files. 34 # 35 #*.=debug;\ 36 # auth,authpriv.none;\ 37 # news.none;mail.none -/var/log/debug 38 #*.=info;*.=notice;*.=warn;\ 39 # auth,authpriv.none;\ 40 # cron,daemon.none;\ 41 # mail,news.none -/var/log/messages
把注释取消掉即可！
3 重启rsyslog服务
sudo restart rsyslog此时，你查看messages仍然没有你想要的信息。因为这个文件相当于刚刚创立好。这时你可以重新
rmmod hellomod #卸载内核模块 insmod hellomod.ko然后
tail -f /var/log/messages就可以查看相应的信息了。
May 5 11:38:25 RiverPc rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="3004" x-info="http://www.rsyslog.com May 5 11:38:25 RiverPc rsyslogd: rsyslogd's groupid changed to 104 May 5 11:38:25 RiverPc rsyslogd: rsyslogd's userid changed to 101 May 5 11:38:27 RiverPc rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="3004" x-info="http://www.rsyslog.com May 5 11:38:27 RiverPc rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="3018" x-info="http://www.rsyslog.com May 5 11:38:27 RiverPc rsyslogd: rsyslogd's groupid changed to 104 May 5 11:38:27 RiverPc rsyslogd: rsyslogd's userid changed to 101 May 5 11:40:56 RiverPc kernel: [ 2464.029618] Good Bye May 5 11:41:11 RiverPc kernel: [ 2478.760122] hello world!