Mastering dmesg: How to Read and Control Linux Kernel Logs

The Linux kernel stores log messages in a fixed‑size ring buffer in physical memory; when the buffer fills, older entries are overwritten. The dmesg command reads this buffer and prints its contents, making it essential for inspecting boot messages and diagnosing hardware‑related problems.

Using the dmesg Command

The basic syntax is dmesg [OPTIONS]. Running it without options prints all buffered messages to standard output: dmesg On many systems any user can run dmesg, but some distributions restrict access for non‑root users. In that case the command fails with:

dmesg: readkernel buffer failed: Operation not permitted

To lift the restriction, set the kernel parameter kernel.dmesg_restrict to 0: sudo sysctl -w kernel.dmesg_restrict=0 Because the output is often long, pipe it through a pager such as less or more and keep colour with --color=always: dmesg --color=always | less Filter the output with standard tools; for example, to show only USB‑related messages:

dmesg | grep -i usb

dmesg

reads from the virtual file /proc/kmsg, which provides the interface to the ring buffer. If a syslog daemon is running, reading the file directly can block, so the daemon typically writes the kernel messages to /var/log/dmesg: cat /var/log/dmesg Formatting options help make the output more readable. The -H (or --human) flag produces human‑friendly output, while -T (or --ctime) adds a readable timestamp:

dmesg -T
[Mon Oct 14 14:38:04 2019] IPv6: ADDRCONF(NETDEV_CHANGE): wlp1s0: link becomes ready

Timestamp format can be changed with --time-format (options: ctime, reltime, delta, notime, iso), e.g.: dmesg --time-format=delta Multiple options can be combined, such as dmesg -H -T. To watch messages in real time, use the -w (or --follow) flag: dmesg --follow Output can be limited by facility (source) using -f (or --facility) and by severity level using -l (or --level). Common facilities include kern, user, mail, daemon, auth, syslog, lpr, and news. Example to show only kernel and daemon messages: dmesg -f kern,daemon Severity levels range from emerg (system unusable) to debug. To display only error and critical messages: dmesg -l err,crit The buffer can be cleared with -C (or --clear), which requires root privileges: sudo dmesg -C To clear the buffer while also printing its contents, use -c (or --read-clear): sudo dmesg -c Before clearing, you may want to save the current log to a file:

dmesg > dmesg_messages

Conclusion

The dmesg utility provides direct access to the kernel’s ring buffer, offering valuable insight for troubleshooting kernel or hardware issues. For a complete list of options, consult the manual page with man dmesg.