Introduction
The dmesg command is a Linux utility that displays kernel-related messages retrieved from the kernel ring buffer. The ring buffer stores information about hardware, device driver initialization, and kernel module messages during system startup.
The dmesg command is invaluable when troubleshooting hardware-related errors and warnings and diagnosing device failure.
In this tutorial, you will learn how to use the dmesg command in Linux.
Prerequisites
- A computer system running Linux.
- A user account with sudo or root privileges.
- Access to the terminal.
Linux dmesg Command Syntax
The basic dmesg command syntax is:
dmesg [options]While the command runs without any options, providing arguments helps you customize how dmesg works.
dmesg Options
There are many options for the dmesg command. The table below lists the most commonly used options:
| Option | Description |
|---|---|
-C, --clear | Clears the ring buffer. |
-c, --read-clear | Prints the ring buffer contents and then clears. |
-f, --facility [list] | Restricts output to the specified comma-separated facility [list]. |
-H, --human | Enables a human-readable output. |
-L, --color[=auto|never|always] | Adds color to the output. Omitting the [auto|never|always] arguments defaults to auto. |
-l, --level [list] | Restricts the output to the specified comma-separated level list. |
--noescape | Disables the feature of automatically escaping unprintable and potentially unsafe characters. |
-S, --syslog | Instructs dmesg to use the syslog kernel interface to read kernel messages. The default is to use /dev/kmsg instead of syslog. |
-s, --buffer-size [size] | Uses the specified buffer size to query the kernel ring buffer. The default value is 16392. |
-T, --ctime | Prints human-readable timestamps. |
-t, --notime | Instructs dmesg not to print kernel's timestamps. |
--time-format [format] | Prints timestamps using the specified [format]. The accepted formats are ctime, reltime, delta, and iso (a dmesg implementation of the ISO-8601 format). |
-w, --follow | Keeps dmesg running and waiting for new messages. The feature is available only on systems with a readable /dev/kmsg file. |
-x, --decode | Decodes the facility and level numbers to human-readable prefixes. |
-h, --help | Displays the help file with all the available options. |
Linux dmesg Command Examples
dmesg is used to check for hardware errors or driver issues when troubleshooting system startup or connectivity problems. The examples below represent common dmesg command use cases.
Display All Messages from Kernel Ring Buffer
Invoking dmesg without any options outputs the entire kernel buffer without stops and with no way to navigate the output.
sudo dmesg
For easier navigation and better readability, pipe the dmesg output into a terminal pager such as less or more, or use grep.
For example, run:
sudo dmesg | less
Piping dmesg into less allows you to use the search function to locate and highlight items. Activate search by pressing /. Navigate to the next screen using the Space bar or reverse using the B key. Exit the output by pressing Q.
Display Colored Messages
By default, dmesg produces a colored output. If the output isn't colored, use the -L option to colorize it.
Run the following:
sudo dmesg -L
To turn off the colored output, append the --color=never option to dmesg:
sudo dmesg --color=never
The default dmesg output is now uniform in color.
Display Messages as They Arrive
Monitor the kernel ring buffer in real-time using the --follow option. The option instructs the command to wait for new messages related to hardware or kernel modules after system startup.
Run the following dmesg command to enable real-time kernel ring buffer monitoring:
sudo dmesg --followThe command displays any new messages at the bottom of the terminal window. Stop the process using Ctrl+C.
Note: Run any command repeatedly with the Linux watch command.
Search for a Specific Term
When searching for specific issues or hardware messages, pipe the dmesg output into grep to search for a particular string or pattern.
For example, if you are looking for messages about memory, run the following command:
sudo dmesg | grep -i memory
The output shows all the lines from the buffer containing the memory string. The -i (ignore case) switch ignores care sensitivity.
Alternatively, if you are looking for buffer messages about USB, serial ports, network, or hard drives, run the following commands:
USB
dmesg | grep -i usbSerial Ports
dmesg | grep -i ttyNetwork
dmesg | grep -i ethHard Drives
sudo dmesg | grep -i sdaSearch for multiple terms at once by appending the -E option to grep and providing the search terms encased in quotations, separated by pipe delimiters. For example:
sudo dmesg | grep -E "memory|tty"
The output prints all the messages containing any of the search terms.
Read and Clear dmesg Logs
The -c (--read-clear) option lets you clear the dmesg log after printing it. Clearing the buffer ensures you have only valid messages from the latest reboot.
Note: To save the entire log in a file before clearing it, redirect the output to a file with sudo dmesg > log_file.
Run the following command:
sudo dmesg -cRerunning dmesg has no output since the log has been cleared.
Enable Timestamps in dmesg Logs
Enable timestamps in dmesg output by appending it to the -H (--human) option, which produces a human-readable output and automatically pipes the output to a pager (less).
Run the following command:
sudo dmesg -H
The command adds a timestamp with the date and time in minutes. The events in the same minute are labeled with seconds and nanoseconds.
Quit the pager by pressing Q.
Enable Human-Readable Timestamps
Enable human-readable timestamps using the -T (--ctime) option. The option removes the nanosecond accuracy from the output, but the timestamps are easier to follow.
sudo dmesg -T
The timestamps in the output are standard dates and times, and the resolution is in minutes. The same timestamp is prepended to each action that occurred in the same minute.
Note: Unlike the -H option, the -T option doesn't automatically invoke less.
Choose Timestamp Format
Use the --time-forma=[format] option to choose the timestamp format. The available formats are:
ctime.reltime.delta.notime.iso.
For example, to use the iso format, run:
sudo dmesg --time-format=iso
The timestamp format is now YYYY-MM-DD<T>HH:MM:SS,<microseconds>←+><timezone offset from UTC>.
Note: The iso and ctime may show inaccurate time when the system is suspended and resumed.
Limit dmesg Output to a Specific Facility
Filter the dmesg output to a specific category using the -f option. The system groups messages in the kernel ring buffer into the following facilities (categories):
kern. Kernel messages.user. User-level messages.mail. Mail system messages.daemon. Messages about system daemons.auth. Authorization messages.syslog. Internalsyslogdmessages.lpr. Line printer subsystem messages.news. Network news subsystem messages.
For example, the following command limits the output to messages related to the syslog facility:
sudo dmesg -f syslog
To list messages from multiple facilities, specify a comma-separated list of facilities. For example:
sudo dmesg -f syslog,daemon
Filter Log Levels
The dmesg command associates each buffer message with a log level characterizing message importance. The available levels are:
emerg. Emergency messages.alert. Alerts requiring immediate action.crit. Critical conditions.err. Error messages.warn. Warning messages.notice. Normal but significant conditions.info. Informational messages.debug. Debugging-level messages.
Instruct dmesg to print only the messages matching a certain level using the -l option followed by the level name. For example:
sudo dmesg -l info
The example above extracts only informational messages from the log.
Combine multiple levels in a comma-separated list to retrieve messages from those levels. For example:
sudo dmesg -l notice,warn
The output combines messages from the specified log levels.
Combining Facility and Level
Explicitly show each buffer message's facility and log level at the start of each line using the -x (decode) option.
For example:
sudo dmesg -x
In the example above, each line is prepended with the appropriate facility and log level.
Read dmesg Log File
Each time the system boots up, the messages from the kernel ring buffer are stored in the /var/log/dmesg file. The dmesg command shows the log file contents. If you have issues using the dmesg command, open the log file in a text editor to view the contents.
Note: Read our tutorial for more information on Linux log files and how to read them.
In the example below, we use the cat command to view the log file and pipe it to grep to search for a particular string occurring in the log:
sudo cat /var/log/dmesg | grep amd
The command outputs all amd string instances in the log file.
Check for a CD Drive
Check if a remote machine is equipped with a CD drive by inspecting the buffer message log. For example, the following command shows all messages about CD devices initialized on startup:
sudo dmesg | grep -iE 'cdrom|dvd|cd/rw|cd-rom'
The results display information about the available CD-ROM drives, including the virtual CD-ROM drive on this machine.
Remove sudo Requirement
Removing the requirement for superuser privileges allows any user to run dmesg and view kernel ring buffer messages. Run the following command to remove the sudo requirement:
sudo sysctl -w kernel.dmesg_restrict=0
After setting the restrictions to 0, any user on the system can run dmesg.
Common dmesg Errors and Challenges
Using dmesg is important for troubleshooting, but it comes with some common challenges that complicate diagnostics. Issues like permission restrictions, overwritten messages due to buffer limits, and hard-to-read timestamps limit its effectiveness.
The following text presents common dmesg errors and challenges.
Insufficient Permissions
Running dmesg as a regular user shows limited output because some kernel messages are restricted for security, especially those that contain sensitive information about system operations and hardware. This restriction helps protect against unauthorized access to potentially sensitive system data.
To view all kernel messages, including those restricted by permissions, use sudo dmesg to grant elevated privileges. Running dmesg with sudo ensures you get the complete log, which is essential for troubleshooting issues or diagnosing errors related to hardware and drivers.
Missing Messages and Message Limit
The kernel ring buffer is a fixed-size memory area that stores kernel messages, which means it only holds a limited number of log entries. As new messages are added, older ones are overwritten, which can cause important information to be lost, especially on systems with frequent kernel activity.
To capture messages before they're lost, check dmesg shortly after an event occurs or use commands like dmesg > filename to save the output to a file for future reference. Redirecting dmesg to a file allows you to keep a persistent log of kernel messages that won't be affected by the buffer’s limits.
Alternatively, set up automatic logging using system tools like syslog to maintain a continuous record of kernel messages.
Interpreting Timestamps
The default timestamps in dmesg are shown as seconds since the system booted, which makes it difficult to correlate kernel events with actual dates and times. This format is useful for tracking the sequence of events relative to startup but confusing when you need to understand when specific events happened.
To make timestamps more readable, use dmesg -T to convert the output into standard date and time format, aligning each message with real-world time. This helps when troubleshooting, as you can match dmesg entries to known issues or events in system logs.
Conclusion
This guide explained how to use the Linux dmesg command to view and control the kernel ring buffer. The utility is convenient when troubleshooting kernel or hardware issues.
Next, check out our tutorial on updating the Linux kernel in Ubuntu or checking the kernel version in Linux.
