Regular programs write messages using printf() to stdout or fprintf(stderr, ...) to stderr. But a daemon:

The solution is syslog — a centralized logging system that: collects messages from all daemons, adds timestamps and metadata, routes messages to different files based on rules, and can even send logs to a remote server over the network.

Step by step:

1. A daemon calls syslog(priority, format, ...)
2. The C library formats the message and writes it to the Unix domain socket /dev/log
3. The syslogd daemon (or its modern replacement rsyslogd) is listening on /dev/log and reads the message
4. syslogd checks its configuration file /etc/syslog.conf to decide where to route the message (which log file, which remote server)
5. The message is written to the appropriate file(s) under /var/log/

Every syslog message carries a facility code that identifies the general category of the source. The facility is used by syslogd to route the message to different files. Think of it as a “tag” identifying the subsystem that generated the log.

Every syslog message also has a priority (also called severity level) that indicates how serious the event is. There are 8 levels, from most critical to least:

In syslog, the priority passed to syslog() is actually a combination of the facility and the severity level. The C library provides the LOG_MAKEPRI(facility, level) macro to combine them, but you usually just OR them together:

/* Combine facility and level with bitwise OR */
syslog(LOG_DAEMON | LOG_ERR,  "Connection failed: %m");
syslog(LOG_AUTH   | LOG_INFO, "User %s logged in", username);
syslog(LOG_LOCAL0 | LOG_DEBUG,"Processing packet %d", seq);

/* If you only specify a level (no facility), the facility
 * set in openlog() is used automatically: */
openlog("myapp", LOG_PID, LOG_DAEMON);
syslog(LOG_ERR,  "This uses LOG_DAEMON facility automatically");
syslog(LOG_INFO, "So does this");

The priority integer is encoded as: priority = (facility << 3) | level. For example, LOG_DAEMON|LOG_ERR = (3<<3)|3 = 27.

#include <stdio.h>
#include <stdlib.h>
#include <syslog.h>
#include <unistd.h>

/*
 * Demonstrates syslog facilities and all priority levels.
 * After running, check: sudo tail -f /var/log/syslog
 */
int main(void)
{
    /* Open syslog connection with program name "syslog_demo",
     * include PID in messages, use LOG_DAEMON facility */
    openlog("syslog_demo", LOG_PID | LOG_PERROR, LOG_DAEMON);

    /* LOG_PERROR also prints to stderr — useful during testing */

    printf("Sending messages to syslog. PID=%d\n", getpid());
    printf("Check: sudo tail -f /var/log/syslog\n\n");

    /* Send one message at each priority level */
    syslog(LOG_EMERG,   "EMERG:   System unusable — test message");
    syslog(LOG_ALERT,   "ALERT:   Action required immediately");
    syslog(LOG_CRIT,    "CRIT:    Critical condition");
    syslog(LOG_ERR,     "ERR:     Error condition — errno: %m");
    syslog(LOG_WARNING, "WARNING: Warning condition");
    syslog(LOG_NOTICE,  "NOTICE:  Normal but significant");
    syslog(LOG_INFO,    "INFO:    Informational message");
    syslog(LOG_DEBUG,   "DEBUG:   Debug details, process=%d", getpid());

    /* Send messages with different facilities */
    syslog(LOG_AUTH   | LOG_INFO,  "AUTH:    Authentication message");
    syslog(LOG_CRON   | LOG_INFO,  "CRON:    Cron-type message");
    syslog(LOG_LOCAL0 | LOG_INFO,  "LOCAL0:  Custom app message");
    syslog(LOG_LOCAL7 | LOG_DEBUG, "LOCAL7:  Custom debug message");

    /* Demonstrate %m — automatic strerror(errno) expansion */
    /* Trigger an error first */
    FILE *f = fopen("/nonexistent/path/file.txt", "r");
    if (!f) {
        /* %m is a syslog extension that inserts strerror(errno) */
        syslog(LOG_ERR, "Failed to open file: %m");
    }

    closelog();

    printf("Done. Check /var/log/syslog for messages.\n");
    return 0;
}

gcc -o syslog_demo syslog_demo.c
./syslog_demo
sudo grep "syslog_demo" /var/log/syslog | tail -20

Kernel messages (from printk()) also enter syslog via a different path: /proc/kmsg. This example shows how to read kernel log messages directly.

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>

/*
 * Kernel log priority levels (same as syslog levels)
 * In /proc/kmsg, each line starts with <N> where N is the level
 */
const char *kernel_level_name(int level)
{
    switch (level) {
        case 0: return "EMERG";
        case 1: return "ALERT";
        case 2: return "CRIT";
        case 3: return "ERR";
        case 4: return "WARNING";
        case 5: return "NOTICE";
        case 6: return "INFO";
        case 7: return "DEBUG";
        default: return "UNKNOWN";
    }
}

/*
 * Read and print kernel log messages from /proc/kmsg
 * Must run as root.
 *
 * Alternative: use dmesg command or the klogctl() syscall.
 */
int main(void)
{
    int fd;
    char buf[1024];
    ssize_t n;

    fd = open("/proc/kmsg", O_RDONLY | O_NONBLOCK);
    if (fd == -1) {
        perror("open /proc/kmsg (need root?)");
        return 1;
    }

    printf("Kernel log messages (reading /proc/kmsg):\n");
    printf("%-10s %s\n", "LEVEL", "MESSAGE");
    printf("%-10s %s\n", "-----", "-------");

    int count = 0;
    while (count < 20) {  /* Read up to 20 messages */
        n = read(fd, buf, sizeof(buf) - 1);
        if (n <= 0) break;

        buf[n] = '\0';

        /* Parse: <level>message text */
        char *p = buf;
        while (*p) {
            if (*p == '<') {
                int level = *(p+1) - '0';
                char *msg_start = strchr(p, '>');
                if (msg_start) {
                    msg_start++;
                    char *newline = strchr(msg_start, '\n');
                    if (newline) *newline = '\0';
                    printf("%-10s %s\n", kernel_level_name(level), msg_start);
                    count++;
                    p = newline ? newline + 1 : p + 1;
                } else p++;
            } else p++;
        }
    }

    close(fd);

    printf("\nNote: Use 'dmesg' for easier kernel log access\n");
    printf("Or: sudo journalctl -k  (systemd systems)\n");
    return 0;
}

gcc -o read_kmsg read_kmsg.c
sudo ./read_kmsg

# Alternative — show kernel messages with dmesg:
dmesg | tail -20
dmesg --level=err,warn   # Only errors and warnings
dmesg -T                 # With human-readable timestamps