LearnLinux › LearnLinux › CMDS

dmesg Command Examples

Diagnostic Message - Your Window into the Kernel

About dmesg

The dmesg command displays the kernel ring buffer, which contains messages from the Linux kernel. These messages include hardware detection during boot, driver loading, system errors, and various kernel-level events. It's an essential tool for system administrators to diagnose hardware issues, driver problems, and system crashes. Understanding dmesg output is crucial for effective Linux troubleshooting.

1. Display All Kernel Messages

$ dmesg

Shows all messages in the kernel ring buffer. This output can be quite long, often thousands of lines containing boot messages, hardware detection, and system events.

What you'll see: Timestamps, subsystem identifiers, and message text describing kernel activities from boot to present.

Use Case: Initial system review after boot, getting a complete picture of kernel activity, or reviewing all messages when you're not sure what you're looking for.
On systems with systemd, kernel messages are also logged to the journal and can be viewed with journalctl -k

2. Display with Human-Readable Timestamps

$ dmesg -T

Shows messages with human-readable timestamps instead of seconds since boot. The -T flag translates kernel timestamps to actual date/time format.

Example output: [Mon Nov 3 14:23:45 2025] instead of [12345.678901]

Use Case: Correlating kernel events with other system logs, identifying exactly when a problem occurred, or creating chronological timelines for incident response.
The -T option requires CAP_SYSLOG capability. On some systems, you may need root privileges to use this flag.

3. Watch Kernel Messages in Real-Time

$ dmesg -w

Enables "follow mode" similar to tail -f, continuously displaying new kernel messages as they appear. This is invaluable for real-time troubleshooting.

Behavior: The command stays running and prints new messages immediately. Press Ctrl+C to exit.

Use Case: Monitoring hardware behavior during testing, watching driver messages when plugging in USB devices, or observing network card behavior during connectivity troubleshooting.
Combine with -T for readable timestamps: dmesg -wT

4. Filter by Log Level (Errors Only)

$ dmesg -l err,crit,alert,emerg

Displays only messages at error level or higher. This filters out informational messages and focuses on actual problems.

Levels included:

  • emerg - System is unusable
  • alert - Action must be taken immediately
  • crit - Critical conditions
  • err - Error conditions
Use Case: Quick health check to see if there are any serious kernel-level errors, troubleshooting system instability, or performing security audits.

5. Search for Specific Hardware or Driver

$ dmesg | grep -i usb

Filters dmesg output to show only lines containing "usb" (case-insensitive). This is useful for focusing on specific subsystems.

Common searches: usb, eth, wlan, sata, bluetooth, nvidia, amd, cpu, memory, disk

Use Case: Troubleshooting USB device recognition, investigating network card issues, checking if a specific driver loaded correctly, or diagnosing hardware-specific problems.
Combine with other tools: dmesg | grep -i 'error\|fail\|warn' to find all problematic messages.

6. Show Last 20 Messages

$ dmesg | tail -20

Displays only the most recent 20 kernel messages. Perfect for quick checks of recent activity without scrolling through thousands of lines.

Why this works: Kernel messages are chronological, so the last messages are the most recent events.

Use Case: Quick check after plugging in a device, investigating what just happened during a system hiccup, or reviewing recent driver activity.
For continuous monitoring of recent messages: dmesg -w | tail -20

7. Clear the Ring Buffer (Root Only)

$ sudo dmesg -C

Clears the kernel ring buffer, removing all current messages. This requires root privileges as it affects system-wide logging.

Important: Messages are cleared from the ring buffer but may still exist in system logs (journalctl, /var/log/kern.log).

Use Case: Starting with a clean slate before testing hardware or drivers, isolating new messages during troubleshooting, or managing buffer space on systems with verbose kernel output.
Use cautiously! You're deleting diagnostic information that might be needed. Consider saving output first with dmesg > /tmp/dmesg-backup.txt

8. Display with Facility Information

$ dmesg -x

Shows messages with both facility and level information in a more structured format. This helps identify which kernel subsystem generated each message.

Format: Each line is prefixed with facility (kern, user, daemon, etc.) and priority level.

Use Case: Advanced troubleshooting where you need to understand exactly which subsystem is reporting issues, filtering by specific facilities, or analyzing kernel behavior patterns.

9. Show Boot Messages Only

$ dmesg | head -100

Displays the first 100 lines of kernel output, which typically contains boot messages. These show hardware initialization, driver loading, and early system setup.

What's in boot messages: CPU detection, memory initialization, PCI device enumeration, disk detection, filesystem mounting.

Use Case: Investigating boot-time hardware detection issues, verifying all devices were recognized, checking driver load order, or diagnosing boot delays.
For a more precise approach on systemd systems: journalctl -k -b shows kernel messages from current boot only.

10. Color-Coded Output by Severity

$ dmesg -L

Enables colored output where different severity levels are displayed in different colors. This makes it much easier to spot errors and warnings at a glance.

Typical colors:

  • Red - Errors and critical messages
  • Yellow/Orange - Warnings
  • Normal - Informational messages
Use Case: Quick visual scanning for problems, making presentations or demonstrations clearer, or just making log review less tedious during long troubleshooting sessions.
Combine flags for maximum readability: dmesg -TL gives you human timestamps AND colors!

Kernel Message Severity Levels

Level Number Description
emerg 0 Emergency - System is unusable
alert 1 Alert - Action must be taken immediately
crit 2 Critical - Critical conditions
err 3 Error - Error conditions
warn 4 Warning - Warning conditions
notice 5 Notice - Normal but significant condition
info 6 Informational - Informational messages
debug 7 Debug - Debug-level messages

Quick Reference: Common dmesg Options

Option Description
-T Show human-readable timestamps
-w Watch/follow mode (continuous output)
-L Colorize output by severity
-l [level] Filter by log level (err, warn, info, etc.)
-x Show facility and level information
-C Clear the ring buffer (requires root)
-H Human-readable output (similar to -T)
-k Show kernel messages only
-u Show userspace messages only
--since Show messages since specified time
--until Show messages until specified time

Related Commands and Tools

  • journalctl -k - View kernel messages from systemd journal (persistent across reboots)
  • tail -f /var/log/kern.log - Monitor kernel log file in real-time (traditional syslog)
  • lspci - List all PCI devices (often used with dmesg to identify hardware)
  • lsusb - List USB devices (pair with dmesg for USB troubleshooting)
  • udevadm monitor - Monitor kernel uevents and udev events in real-time
  • systemd-analyze - Analyze system boot performance using kernel timing data
  • /var/log/syslog - System log file containing kernel and other system messages
  • /proc/kmsg - Kernel message file (raw interface to ring buffer)
Common Troubleshooting Scenarios:
  • USB not recognized: dmesg -wT | grep -i usb
  • Disk errors: dmesg -l err | grep -i 'sd\|sata'
  • Network issues: dmesg | grep -i 'eth\|wlan\|network'
  • Out of memory: dmesg | grep -i 'oom\|memory'
  • Hardware failures: dmesg -l err,crit,alert,emerg
Security Note: On many systems, reading dmesg requires root privileges or membership in specific groups. This is because kernel messages can reveal sensitive system information. If you get "Operation not permitted," try with sudo.
Pro Tip: Save dmesg output before major system changes:
sudo dmesg -T > ~/dmesg-before-upgrade-$(date +%Y%m%d).txt
This creates a timestamped backup for comparison if issues arise.