Hi, I'm trying to configure a centeral log server using syslog-ng. I want all the kernel logs from klogd to also be stored centrally. Following instructions on the Balabit website from the syslog-ng documentation, I have syslog-ng taking in the messages that klogd would normally handle. I'm on Ubuntu Server, so when syslog-ng is installed, klogd is uninstalled by apt-get.

Here is my question: Why is /var/log/dmesg still being written to? Klogd is gone, and syslog-ng is writing the same information to annother file just as I want it to, but /var/log/dmesg still is created on a reboot if i delete it beforehand.

I hope this is clear, if I havent been, let me know and I'll try to explain further.

/var/log/dmesg has nothing to do with klogd, it's created by the bootmisc init script, not a service in itself. if you read the script you'll see it just dumps the contents of dmesg to boot as a one off per boot.