Hello, During 2.6.38 development CAP_SYSLOG has been introduced to perform syslog operations, older CAP_SYS_ADMIN is not sufficient anymore. commit 38ef4c2e437d11b5922723504b62824e96761459 commit ce6ada35bdf710d16582cc4869c26722547e6f11 do_syslog now is as follows: int do_syslog(int type, char __user *buf, int len, bool from_file) { [..] if (type == SYSLOG_ACTION_OPEN || !from_file) { if (dmesg_restrict && !capable(CAP_SYSLOG)) goto warn; /* switch to return -EPERM after 2.6.39 */ if ((type != SYSLOG_ACTION_READ_ALL && type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYSLOG)) goto warn; /* switch to return -EPERM after 2.6.39 */ } [..] CAP_SYSLOG introduced to libcap in version 2.20. #define CAP_SYSLOG 34 Sergey