linux c program is there another way to read logs than reading files in /var/log?

Question

Hello dear community of stackoverflow,

at the moment im programming a tool in c that monitors the linux log files which can be found in /var/log, the c program reads the logs directly from the log files but reading the log files from an c program is is not very good because the user can manipulate log files or the logs got saved in different file eg instead it got saved in syslog it got saved in syslog.1.

Because of this disadvantages i want to ask if there is any alternative in linux instead of reading the files? Maybe it is possible with an kernel module that catches these logs?

Thank you for any answer!

Answer 1

An alternate is to use either /proc/kmsg or /dev/kmsg . User cannot modify these sources of logs. Format will be a bit different but you can change your program to adapt it.