轉載於：https://blog.csdn.net/C_Major/article/details/51321684
1 內核編程insmod后，Ubuntu查看日志無/var/log/messages
寫好簡單內核模塊如hellomod.ko后，執行命令 insmod hellomod.ko 后，查看內核打印的printk信息， tail /var/log/messages 后發現並沒有messages文件。
2 Ubuntu是有/var/log/messages這個文件的！
root@XXX:/home/river# vim /etc/rsyslog.d/50-default.conf
找到
# 33 # Some "catch-all" log files. 34 # 35 #*.=debug;\ 36 # auth,authpriv.none;\ 37 # news.none;mail.none -/var/log/debug 38 #*.=info;*.=notice;*.=warn;\ 39 # auth,authpriv.none;\ 40 # cron,daemon.none;\ 41 # mail,news.none -/var/log/messages
把注釋取消掉即可！
3 重啟rsyslog服務
sudo restart rsyslog此時，你查看messages仍然沒有你想要的信息。因為這個文件相當於剛剛創立好。這時你可以重新
rmmod hellomod #卸載內核模塊 insmod hellomod.ko然后
tail -f /var/log/messages就可以查看相應的信息了。
May 5 11:38:25 RiverPc rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="3004" x-info="http://www.rsyslog.com May 5 11:38:25 RiverPc rsyslogd: rsyslogd's groupid changed to 104 May 5 11:38:25 RiverPc rsyslogd: rsyslogd's userid changed to 101 May 5 11:38:27 RiverPc rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="3004" x-info="http://www.rsyslog.com May 5 11:38:27 RiverPc rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="3018" x-info="http://www.rsyslog.com May 5 11:38:27 RiverPc rsyslogd: rsyslogd's groupid changed to 104 May 5 11:38:27 RiverPc rsyslogd: rsyslogd's userid changed to 101 May 5 11:40:56 RiverPc kernel: [ 2464.029618] Good Bye May 5 11:41:11 RiverPc kernel: [ 2478.760122] hello world!