MontaukOS 0.1.9 was in dire need of a unified logging system. With each version, userspace became more and more complex with new components gradually popping up. By 0.1.9, init (0:/os/init.elf) could already spawn a laundry list of background services:

• DHCP
• Print spooler
• SSH server
• NTP client

Each of these was writing crucial (and potentially security-sensitive) log messages into init‘s terminal session, created by the kernel—which would be destroyed once graphical login was spawned, making the messages impossible to query.

The existing kernel logging apparatus

The MontaukOS kernel already had a relatively simple logging system. KernelLogStream objects would be used by kernel components to write plain-text messages into a 64KiB log buffer. The messages would also be rendered to the screen during early system boot (before handoff to userspace), and could be queried by userspace through system call 46 (SYS_KLOG/montauk::read_klog).

This system did not, however, provide a unified log that 0:/os/init.elf and other userspace services could write into.

Reviewing other operating systems’ approaches

Linux

Linux provides a device file (a writable virtual file that doesn’t actually save anything to disk) at /dev/kmsg, which allows userspace processes to write messages into the kernel’s log buffer.

# echo "hello from userspace" | tee /dev/kmsg
hello from userspace
# dmesg
  . . . 
[11441.532634] hello from userspace

macOS/iOS/iPadOS

Apple replaced the traditional syslog with a unified os_log API on its platforms.

os_log(
    OS_LOG_DEFAULT, // the default shared system log
    "hello from userspace!" // format string
);

The above C++ code example would write the string “hello from userspace!” to the global system log, visible from macOS via the Console app.

The MontaukOS approach

MontaukOS doesn’t have device or otherwise virtual files. Instead, I added a new SYS_LOG_WRITE system call (176) in addition to the existing SYS_KLOG (read, now renamed to SYS_LOG) call, along with the companion userspace wrappers.

This new API allows userspace services and applications alike to write to the system log buffer, maintained by the kernel. The kernel now distinguishes between log types when writing them (KernelLogStream/UserspaceLogStream) while retaining a unified buffer.

montauk::write_log(
    "my_app", // component or application name
    "hello, world!" // string message
);

Above: example C++ block writing a message to the global system log.

The Kernel Log app was also renamed to System Log (0:/apps/syslog/syslog.elf) and now displays both kernel and userspace logs.

Next steps for the MontaukOS logging system

By the release of version 0.2.0, system services—including DHCP, the NTP client, and the SSH server—will be adapted to use the new logging system rather than printing into the void.

The kernel will also append security information, such as the user running the process, to log messages.

Links

os_log – Apple developer documentation

MontaukOS source code

Download MontaukOS