dmesg Kernel Messages

dmesg cheatsheet — read kernel messages, filter errors, watch live output. dmesg -T for timestamps, dmesg --level=err, dmesg -w to follow. Linux kernel log reference.

3 min read

What it is

dmesg displays the kernel ring buffer messages, useful for diagnosing hardware issues, driver problems, and system startup events.

Installation

dmesg is a standard utility and is available on virtually all Linux and macOS systems. It typically comes pre-installed with the kernel.

Commands / Usage

Viewing Messages

  • dmesg Display all kernel ring buffer messages.

  • dmesg -H Display kernel ring buffer messages with a human-readable timestamp and colorized output.

  • dmesg -T Display kernel ring buffer messages with human-readable timestamps.

  • dmesg -k Display only kernel messages (default behavior).

  • dmesg -l crit,err,warn Display kernel messages filtered by severity level (critical, error, warning).

  • dmesg -f raw,user Display kernel messages filtered by facility (raw, user).

  • dmesg -x Decode facility and level codes to human-readable strings.

Controlling Output

  • dmesg -n 8 Set the console logging level to 8 (all messages). This affects future kernel messages, not those already in the buffer.

  • dmesg -f 1 Set the console logging facility to 1 (kernel).

Clearing the Buffer

  • sudo dmesg -c Clear the kernel ring buffer after printing its contents. Use with caution, as this is a destructive operation. This is often used after a reboot to see only the messages from the current boot.

Following Messages

  • dmesg -w Watch for new kernel messages in real-time. Similar to tail -f /var/log/kern.log.

Filtering and Searching

  • dmesg | grep -i "usb" Filter dmesg output to show lines containing "usb" (case-insensitive).

  • dmesg | grep "error" Filter dmesg output to show lines containing "error".

  • dmesg -l err Display only error messages.

  • dmesg -e Display messages with extended information (e.g., CPU, process ID).

Timestamp Control

  • dmesg --time-format iso Display timestamps in ISO 8601 format.

  • dmesg --time-format delta Display timestamps as a delta from the earliest message.

Common Patterns

Checking for USB device connection issues:

dmesg | grep -i "usb"

This is a quick way to see if the kernel detected a USB device being plugged in and if there were any errors during its enumeration.

Investigating boot-time hardware problems:

sudo dmesg -c

After a reboot, run this command. It will print all messages from the current boot session and then clear the buffer. This helps isolate issues that occurred specifically during startup.

Real-time monitoring for kernel events:

dmesg -w

Leave this running in a terminal to see kernel messages as they happen. Useful for debugging intermittent issues or observing system behavior.

Finding specific hardware driver messages:

dmesg | grep -i "snd" # For sound card drivers
dmesg | grep -i "nvme" # For NVMe SSDs
dmesg | grep -i "eth" # For Ethernet network interfaces

Replace "snd", "nvme", or "eth" with the relevant driver or hardware identifier you suspect is causing problems.

Examining messages with human-readable timestamps:

dmesg -HT

This provides a more understandable view of when kernel events occurred, especially when correlating with other system logs.

Gotchas

  • Permissions: On some systems, you might need sudo to view certain kernel messages or to clear the buffer (sudo dmesg -c).
  • Clearing Buffer: sudo dmesg -c discards the messages from the buffer. If you need to analyze them later, view them before clearing.
  • Buffer Size: The kernel ring buffer has a finite size. Older messages will be overwritten by newer ones. If you’re debugging a long-running issue, the relevant messages might have already been lost.
  • dmesg -w vs. tail -f /var/log/kern.log: While dmesg -w shows live kernel messages, traditional log files like /var/log/kern.log (or /var/log/messages on some systems) often contain more context, historical data, and messages from userspace daemons related to kernel events. dmesg is primarily for the kernel’s internal buffer.
  • Timestamp Interpretation: Timestamps can be relative to boot time or absolute human-readable times depending on the flags used (-T, -H, --time-format). Be aware of which format you are seeing.