dmesg

Show kernel messages

$ sudo dmesg

$ sudo dmesg [[-l|--level]] err

$ sudo dmesg [[-w|--follow]]

$ sudo dmesg | grep [[-i|--ignore-case]] memory

$ sudo dmesg | less

$ sudo dmesg [[-T|--ctime]]

$ sudo dmesg [[-H|--human]]

$ sudo dmesg [[-L|--color]]

dmesg [options]

-c, --clear
    Clears the kernel ring buffer after printing its contents. This can be useful to start with a fresh log for specific debugging sessions.

-H, --human
    Enables human-readable output. This option paginates the output and shows timestamps in a more digestible format, similar to --ctime.

-k, --kernel
    Displays only messages from the kernel. This is often the default behavior but can be used to explicitly filter out userspace messages if any are present.

-l <level>, --level <level>
    Restricts output to messages with a specific log level, such as `emerg`, `alert`, `crit`, `err`, `warn`, `notice`, `info`, or `debug`.

-n <level>, --console-level <level>
    Sets the console log level. Messages with a level lower than the specified value will not be printed to the console. This requires root privileges.

-r, --raw
    Prints the raw messages, without parsing facility or level codes. This is useful for exact matching or specific parsing needs.

-s <size>, --buffer-size <size>
    Specifies the size of the kernel ring buffer to query. Useful if the default buffer size is too small or you suspect messages are being truncated.

-T, --ctime
    Prints human-readable timestamps. This option converts the kernel's uptime-based timestamps into absolute, human-readable dates and times.

-t, --time
    Prints the seconds since boot as a timestamp, along with the facility and level. This is less human-readable than -T but precise.

-u, --user
    Displays only messages originating from userspace. This is less common but can be useful when debugging specific userspace components that log to the kernel buffer.

-w, --follow
    Follows the output, similar to tail -f. dmesg will continue to print new messages as they are added to the kernel ring buffer.

-x, --decode-and-pretty
    Decodes the facility and level, and pretty-prints the output. This option provides a more structured and readable format than the default.

dmesg is a crucial Linux command used to examine the kernel ring buffer. This buffer stores messages produced by the kernel during system boot-up and operation. These messages include information about detected hardware, device driver initialization, kernel module loading, and any system errors or warnings.

The primary purpose of dmesg is for system debugging and troubleshooting. When issues arise, such as a hardware component not being recognized or a driver failing to load, dmesg provides a chronological log of kernel events that can help identify the root cause. Unlike general system logs (like those managed by `syslog` or `journald`), the kernel ring buffer is held entirely in memory and contains messages directly from the kernel itself, often before other logging services are fully operational. This makes it invaluable for diagnosing boot-time problems.

While the buffer's content is ephemeral (it's cleared on each reboot), dmesg allows administrators and users to view the current state of the kernel's internal logging. The output can be extensive, so it's frequently piped to tools like grep, less, or more for filtering and easier navigation.

The kernel ring buffer is a volatile, in-memory buffer. Its contents are cleared with each system reboot. For persistent logging, rely on syslog or journald which typically capture and store dmesg output in files like `/var/log/dmesg` or integrate it into their main logs.

The size of the kernel ring buffer is fixed and finite. If the system generates many messages, older messages may be overwritten (ring buffer behavior). Use -s or check kernel parameters to understand/adjust this size.

Setting console log levels (-n) or clearing the buffer (-c) requires root privileges. Reading the buffer (default dmesg) usually does not, making it accessible to regular users for diagnostic purposes.

By default, dmesg reads messages from `/dev/kmsg`, a character device that acts as the interface to the kernel ring buffer. While `/dev/kmsg` itself often requires root access for direct reading or writing, dmesg usually uses a mechanism that allows non-root users to read the buffer contents for diagnostic purposes, although writing (e.g., clearing the buffer or changing console log levels) still requires elevated privileges.

To view recent messages, dmesg | tail is common. For searching errors, dmesg | grep -i error is frequently used. To view messages with human-readable timestamps and pagination, dmesg -H or dmesg -T | less are popular choices.

The dmesg command has a long history, dating back to early Unix-like operating systems. It was originally implemented to provide a simple way for system administrators to view messages generated by the kernel during system boot-up and runtime. As Linux evolved, dmesg became a standard utility for kernel diagnostics, forming part of the essential util-linux package. While modern logging systems like `systemd-journald` offer more comprehensive and persistent logging, dmesg remains indispensable for inspecting the raw, in-memory kernel ring buffer, particularly for low-level hardware and boot-time issues that might occur before full logging services are active. Its core functionality has remained remarkably consistent over decades, with new options added to enhance filtering, formatting, and timestamping capabilities.

journalctl(1), syslog(2), rsyslogd(8), syslogd(8), tail(1), grep(1), less(1)