LOG(5)

NAME
log - format of security logging records

SYNOPSIS
#include <sys/log.h>

DESCRIPTION
The structure of system log file records as declared in <sys/log.h> is
    struct	logbuf	{
    	short	len;		/* total length of whole record */
    	short	pid;		/* process id */
    	long	slug;		/* transaction number */
    	char	code;		/* kind of record */
    	char	mode;		/* sub-kind */
    	char	colon;		/* ':', aids sync */
    	char	body[LOGLEN];
    };
The code field identifies the kind of record; for legal values see the include file. In kernel records the mode field identifies where in the kernel the logging record originated, for user records it contains the minor device number of the /dev/log/logxx file used to create the record.

The body field contains the logging record proper; its actual length is determined from the len field. In kernel records the body is a sequence of values, each prefixed by one or more format bytes according to the following list. Multibyte numbers are represented low byte first.

s   Next two bytes are a byte count for following string.

$   Next one byte is a byte count for following string, which is typically a file component name.

C   Next byte is a byte count for following string, which is the command name.

j   Next value is a security label: two bytes of lb_priv followed by two bytes of index into the kernel's shared label table for the lattice value of the label; see getflab(2).

J   Next value is a security label: two bytes of lb_priv followed by two bytes of index into the kernel's shared label table for the lattice value of the label, followed by 60 bytes of bits of the lattice value of the label.

n   Next n bytes (n=1,2,3,4) represent a number.

I   Next bytes name an inode: two bytes of device followed by two bytes of inumber.

E   The current system call suffered an ELAB error.

e   Next byte is an errno code; see intro(2).

The various bits of the log mask (see syslog(2) are named LN, LS, LU, LI, LD, LP, LL, LA, LX, LE, LT, with the same meanings as the corresponding key letters defined in syslog(8).

FILES

SEE ALSO
syslog(2), log(4), syslog(8)

BUGS
The various kinds of kernel logging records are understandable only by reading the kernel source code.
It takes 7 bytes, not 4, to name an inode.