Starting with Android 5, the in-kernel logger driver is deprecated which exposed the ring buffers through
/dev/log/* character devices. Instead a userspace logging daemon named logd manages buffers “main”, “system”, “radio”, “events”, and “crash”. Optional buffers “security” (e.g. for
pull logging) and on
userdebug builds “kernel” (for
klogd) and “stats” (for logs statistics) were added later.
logd mainly covers the functionality of its desktop counterpart syslogd, but also includes klogd and partially auditd to get logs from SELinux subsystem of kernel. Behavior of logging daemon is controlled through different properties.
Apps and native processes write their logs to relevant buffers through socket
/dev/socket/logdw (by making use of liblog functions).
logcat command reads the buffers from
/dev/socket/logdr while controls the daemon and buffers through
/dev/socket/logd socket. Use
-G options to get and set size of individual buffers:
Get the size of the ring buffer.
-G <size>, --buffer-size=<size>
Set size of log ring buffer, may suffix with K or M.
There's also an option in Developer Options: Logger buffer sizes (which also sets property
persist.logd.size) to set same size for all buffers.
persist.logd.size is read from
/data/property/ which isn't available unless
/data is mounted and decrypted (in case of FDE). But sometimes buffers may overflow even before that, so the solution is to set
build.prop or directly in some
*.rc file) before the
logd service is started.