# imklog: Kernel Log Input Module

Module Name: | imklog
Author: | Rainer Gerhards <rgerhards@adiscon.com>

## Purpose

Reads messages from the kernel log and submits them to the syslog engine.

## Configuration Parameters

Note

Parameter names are case-insensitive; camelCase is recommended for readability.

### Module Parameters

Parameter | Summary
--- | ---
InternalMsgFacility | Sets the facility used for messages that imklog generates internally.
PermitNonKernelFacility | Controls whether imklog submits kernel log messages that use non-kernel facilities.
ConsoleLogLevel | Filters kernel console messages, printing only those with a severity up to the configured level.
ParseKernelTimestamp | Parses kernel-provided timestamps and uses them as the message time instead of the receive time.
KeepKernelTimestamp | Keeps the kernel-supplied timestamp prefix in each message when kernel timestamps are parsed.
LogPath | Specifies the kernel log device or file that imklog reads.
RatelimitInterval | Sets the interval window for the imklog rate limiter in seconds.
RatelimitBurst | Specifies how many messages imklog can emit within the configured rate-limiting interval.

## Caveats/Known Bugs

This is obviously platform specific and requires platform drivers. Currently, imklog functionality is available on Linux and BSD.

This module is not supported on Solaris and not needed there. For Solaris kernel input, use imsolaris.

## Example 1

The following sample pulls messages from the kernel log. All parameters are left by default, which is usually a good idea. Please note that loading the plugin is sufficient to activate it. No directive is needed to start pulling kernel messages.

    module(load="imklog")

## Example 2

The following sample adds a ratelimiter. The burst and interval are set high to allow for a large volume of messages on boot.

    module(load="imklog" RatelimitBurst="5000" RatelimitInterval="5")

## Unsupported `obsolete legacy` directives

$DebugPrintKernelSymbols on/off

  Linux only, ignored on other platforms (but may be specified). Defaults to off.

$klogLocalIPIF

  This directive is no longer supported. Instead, use the global $localHostIPIF directive instead.

$klogUseSyscallInterface on/off

  Linux only, ignored on other platforms (but may be specified). Defaults to off.

$klogSymbolsTwice on/off

  Linux only, ignored on other platforms (but may be specified). Defaults to off.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.