dmesg

Show kernel messages

$ sudo dmesg

$ sudo dmesg [[-l|--level]] err

$ sudo dmesg [[-w|--follow]]

$ sudo dmesg | grep [[-i|--ignore-case]] memory

$ sudo dmesg | less

$ sudo dmesg [[-T|--ctime]]

$ sudo dmesg [[-H|--human]]

$ sudo dmesg [[-L|--color]]

dmesg [options]

-c
    Clear the kernel ring buffer after printing.

-D
    Do not display timestamps.

-E
    Direct output to stderr.

-f ,...
    Restrict output to the specified facility or facilities.

-H
    Use human-readable output.

-k
    Display kernel messages.

-l ,...
    Restrict output to the specified level(s).

-n
    Set the console reporting level.

-P
    Disable pager use.

-r
    Produce raw output.

-s
    Use a buffer size of .

-T
    Print human-readable timestamps.

-t
    Display only timestamps.

-x
    Decode facility and level names.

-w
    Wait for new messages.

--clear
    Clear the kernel ring buffer after printing.

--console-if=
    Restrict output to console if matches.

--ctime
    Print human-readable timestamps.

--dmesg
    Print dmesg messages.

--facility=,...
    Restrict output to the specified facility or facilities.

--file=
    Read dmesg messages from .

--follow
    Wait for new messages.

--help
    Display help text and exit.

--kernel
    Display kernel messages.

--level=,...
    Restrict output to the specified level(s).

--noescape
    Produce raw output.

--notime
    Do not display timestamps.

--raw
    Produce raw output.

--rfc3164
    Print RFC3164 compliant timestamps.

--syslog
    Decode facility and level names.

--time
    Display only timestamps.

--version
    Display version information and exit.

dmesg is a crucial Linux command used to examine the kernel ring buffer. This buffer stores messages generated by the kernel, including hardware-related events, driver information, error messages, and general system activity. It provides valuable insights into the system's operational status, especially during boot or when troubleshooting hardware or driver problems.
The command presents these messages chronologically, enabling users to diagnose issues, identify hardware failures, and understand the sequence of events that occurred within the kernel. Often, this output is used in conjunction with other tools, such as `journalctl`, for comprehensive system analysis.
Without any options, `dmesg` prints the entire buffer content. Its output can be piped to tools like `grep` for filtering specific events, like displaying all errors related to a particular hardware device. The command is indispensable for system administrators and developers seeking to understand and resolve kernel-level issues.

The size of the kernel ring buffer is limited, so older messages may be overwritten as new ones are generated. Therefore, `dmesg` might not contain a complete history of events.

Kernel log levels (e.g., `emerg`, `alert`, `crit`, `err`, `warn`, `notice`, `info`, `debug`) indicate the severity of the message. Filtering by level allows users to focus on critical issues. Critical Errors and Warnings are particularly important to monitor when troubleshooting system issues. Consult the syslog manual or kernel documentation for a complete list and explanation.

dmesg is commonly piped to grep to filter for specific keywords. For example, dmesg | grep 'error' will display only the messages containing the word 'error'. This makes it easier to identify and isolate relevant events from the buffer. This is especially useful when a very verbose output is generated and you need to find a specific event.

Be aware that the contents of the ring buffer can contain sensitive information, such as usernames, network addresses, or other data transmitted to the kernel from userspace. If you are working in a security-sensitive environment, you should ensure that access to the output of dmesg is properly restricted using file permissions.

The dmesg command has been a staple of Unix-like systems since their early days. It's a fundamental tool for examining the kernel's activity. Over time, its capabilities have been expanded to include more options for filtering, formatting, and controlling the output, making it more versatile for debugging and system monitoring. It remains an essential utility for administrators and developers alike.

journalctl(1), syslog(1), klogd(8)