Mastering dmesg: How to Read and Control Linux Kernel Logs

What is dmesg?

The Linux kernel writes diagnostic messages to a fixed‑size ring buffer in memory. The dmesg utility reads that buffer and prints the messages, which is useful for examining boot logs and troubleshooting hardware or kernel issues.

Basic usage

dmesg [OPTIONS]

Without any options, dmesg outputs the entire contents of the kernel ring buffer to standard output.

$ dmesg

Common options

-H, --human

: format numeric values (e.g., sizes) in human‑readable units. -T, --ctime: display timestamps as local date‑time strings. --time-format=delta|ctime|reltime|iso|notime: choose the timestamp representation. delta shows time since the previous message, reltime shows time since boot, iso uses ISO‑8601 format, and notime suppresses timestamps. -l, --level <list>: restrict output to the specified log levels (comma‑separated). Example: -l err,crit shows only error and critical messages. -f, --facility <list>: restrict output to particular facilities (comma‑separated). Example: -f kern,daemon shows only kernel and daemon messages. --color=always: preserve ANSI colour codes when piping the output. -w, --follow: continuously display new messages as they are added to the buffer. -C, --clear: clear the ring buffer (requires root privileges). -c, --read-clear: display the buffer and then clear it.

Viewing and filtering output

Because the output can be very long, pipe it to a pager for easier navigation: $ dmesg --color=always | less Use standard text‑processing tools to filter specific entries. For example, to show only USB‑related messages: $ dmesg | grep -i usb The kernel writes messages to the virtual file /proc/kmsg, which provides the interface to the ring buffer. If a syslog daemon is running, it may consume /proc/kmsg, causing direct reads to block.

Syslog daemons typically dump the kernel messages to /var/log/dmesg, so you can also examine that file:

$ cat /var/log/dmesg

Facilities

Facilities categorize the source of a message. Common facilities include: kern – kernel messages user – user‑level messages mail – mail subsystem daemon – system daemons auth – security/authorization syslog – internal syslogd messages lpr – line printer subsystem news – network news subsystem

Log levels

Each message has an associated severity level. The levels recognized by dmesg are: emerg – system unusable alert – immediate action required crit – critical condition err – error condition warn – warning condition notice – normal but significant info – informational debug – debug-level messages

Clearing the ring buffer

Only the root user (or a user with sudo) can clear the buffer. $ sudo dmesg -C If you want to display the current contents before clearing, use:

$ sudo dmesg -c

Permissions

On many distributions, non‑privileged users are prevented from reading the kernel buffer by the sysctl setting kernel.dmesg_restrict. To lift the restriction (requires root):

$ sudo sysctl -w kernel.dmesg_restrict=0

Saving output

Redirect the output to a file for later analysis:

$ dmesg > dmesg_log.txt

Further information

Consult the manual page ( man dmesg) for a complete list of options and examples of advanced usage.