How to Use the dmesg Linux Command

January 18, 2022

Introduction

The dmesg command is a Linux utility that displays kernel-related messages retrieved from the kernel ring buffer. The ring buffer stores information about hardware, device driver initialization, and messages from kernel modules that take place during system startup.

The dmesg command is invaluable when troubleshooting hardware-related errors, warnings, and for diagnosing device failure.

In this tutorial, you will learn how to use the dmesg command in Linux.

How to use the dmesg Linux command.

Prerequisites

  • A computer system running Linux.
  • A user account with administrator privileges.

Syntax and Options

The basic dmesg command syntax is:

dmesg [options]

The table below lists the most commonly used dmesg options:

OptionDescription
-C, --clearClears the ring buffer.
-c, --read-clearPrints the ring buffer contents and then clears.
-f, --facility [list]Restricts output to the specified comma-separated facility [list].
-H, --humanEnables a human-readable output.
-L, --color[=auto|never|always]Adds color to the output. Omitting the [auto|never|always] arguments defaults to auto.
-l, --level [list]Restricts the output to the specified comma-separated level list.
--noescapeDisables the feature of automatically escaping unprintable and potentially unsafe characters.
-S, --syslogInstructs dmesg to use the syslog kernel interface to read kernel messages. The default is to use /dev/kmsg instead of syslog.
-s, --buffer-size [size]Uses the specified buffer size to query the kernel ring buffer. The default value is 16392.
-T, --ctimePrints human-readable timestamps.
-t, --notimeInstructs dmesg not to print kernel's timestamps.
--time-format [format]Prints timestamps using the specified [format]. The accepted formats are ctime, reltime, delta, and iso (a dmesg implementation of the ISO-8601 format).
-w, --followKeeps dmesg running and waiting for new messages. The feature is available only on systems with a readable /dev/kmsg file.
-x, --decodeDecodes the facility and level numbers to human-readable prefixes.
-h, --helpDisplays the help file with all the available options.

Linux dmesg Command Examples

The examples are common dmesg command use cases.

Display All Messages from Kernel Ring Buffer

Invoking dmesg without any options outputs the entire kernel buffer, without stops, and with no way to navigate the output.

sudo dmesg
A partial output of the Linux dmesg command.

The example above is a partial dmesg command output. For easier navigation and better readability, pipe the dmesg output into a terminal pager such as less, more, or use grep.

For example:

sudo dmesg | less
Piping dmesg into less for easier navigation.

Piping dmesg into less allows you to use the search function to locate and highlight items. Activate search by pressing /. Navigate to the next screen using the Space bar, or reverse using the B key. Exit the output by pressing Q.

Note: Read our article and learn more about the less command in Linux.

Display Colored Messages

By default, dmesg produces a colored output. If the output isn't colored, use the -L option to colorize it.

sudo dmesg -L
Adding color to dmesg output.

To turn off colored outputs, append the --color=never option to dmesg. Run the following command:

sudo dmesg --color=never
Removing color from dmesg output.

The default dmesg output is now uniform in color.

Display Messages as They Arrive

Monitor the kernel ring buffer in real-time using the --follow option. The option instructs the command to wait for new messages related to hardware or kernel modules after system startup.

Run the following dmesg command to enable real-time kernel ring buffer monitoring:

sudo dmesg --follow

The command displays any new messages at the bottom of the terminal window. Stop the process using Ctrl+C.

Note: Run any command repeatedly with the Linux watch command.

Search for a Specific Term

When searching for specific issues or hardware messages, pipe the dmesg output into grep to search for a particular string or pattern.

For example, if you are looking for messages about memory, run the following command:

dmesg | grep -i memory
Searching for a specific term in the dmesg log.

The output shows all the lines from the buffer containing the memory string. The -i (ignore case) switch ignores care sensitivity.

Alternatively, if you are looking for buffer messages about USB, serial ports, network, or hard drives, run the following commands:

USB

dmesg | grep -i usb

Serial Ports

dmesg | grep -i tty

Network

dmesg | grep -i eth

Hard Drives

sudo dmesg | grep -i sda

Search for multiple terms at once by appending the -E option to grep and providing the search terms encased in quotations, separated by pipe delimiters. For example:

sudo dmesg | grep -E "memory|tty"
Searching for multiple terms in the dmesg log.

The output prints all the messages containing any of the search terms.

Read and Clear dmesg Logs

The -c (--read-clear) option lets you clear the dmesg log after printing it. Clearing the buffer ensures you have only valid messages from the latest reboot.

Note: To save the entire log in a file before clearing it, redirect the output to a file with sudo dmesg > log_file.

Run the following command:

sudo dmesg -c

Rerunning dmesg has no output since the log has been cleared.

Clearing the dmesg log.

Enable Timestamps in dmesg Logs

Enable timestamps in dmesg output by appending it with the -H (--human) option, which produces a human-readable output and automatically pipes the output into a pager (less).

Run the following command:

sudo dmesg -H
Enabling log message timestamps in the dmesg output.

The command adds a timestamp with the date and time resolved in minutes. The events in the same minute are labeled with seconds and nanoseconds.

Quit the pager by pressing Q.

Enable Human-Readable Timestamps

Enable human-readable timestamps using the -T (--ctime) option. The option removes the nanosecond accuracy from the output, but the timestamps are easier to follow.

sudo dmesg -T
Generating human-readable timestamps in the dmesg command output.

The timestamps in the output are standard dates and time, and the resolution is in minutes. The same timestamp is prepended to each action that occurred in the same minute.

Note: Unlike the -H option, the -T option doesn't automatically invoke less.

Choose Timestamp Format

Use the --time-format [format] option to choose the timestamp format. The available formats are:

  • ctime
  • reltime
  • delta
  • notime
  • iso

For example, to use the iso format, run:

sudo dmesg --time-format=iso
Changing the format of dmesg timestamps.

The timestamp format is now YYYY-MM-DD<T>HH:MM:SS,<microseconds>←+><timezone offset from UTC>.

Note: The iso and ctime may show inaccurate time when the system is suspended and resumed.

Limit dmesg Output to a Specific Facility

Filter the dmesg output to a specific category using the -f option. The system groups messages in the kernel ring buffer into the following facilities (categories):

  • kern. Kernel messages.
  • user. User-level messages.
  • mail. Mail system messages.
  • daemon. Messages about system daemons.
  • auth. Authorization messages.
  • syslog. Internal syslogd messages.
  • lpr. Line printer subsystem messages.
  • news. Network news subsystem messages.

For example, the following command limits the output to messages related to the syslog facility:

sudo dmesg -f syslog
Showing log messages from a single facility in dmesg output.

To list messages from more than one facility, specify a comma-separated list of facilities. For example:

sudo dmesg -f syslog,daemon
Showing log messages from multiple facilities in dmesg.

Filter Log Levels

The dmesg command associates each buffer message with a log level characterizing message importance. The available levels are:

  • emerg. Emergency messages.
  • alert. Alerts requiring immediate action.
  • crit. Critical conditions.
  • err. Error messages.
  • warn. Warning messages.
  • notice. Normal but significant conditions.
  • info. Informational messages.
  • debug. Debugging-level messages.

Instruct dmesg to print only the messages matching a certain level using the -l option, followed by the level name. For example:

sudo dmesg -l info
Filtering dmesg output to print only a certain log level messages.

The example above extracts only informational messages from the log.

Combine multiple levels in a comma-separated list to retrieve messages from those levels. For example:

sudo dmesg -l notice,warn
Filtering dmesg output to print messages from multiple log levels.

The output combines messages from the specified log levels.

Combining Facility and Level

Explicitly show each buffer message's facility and log level at the start of each line using the -x (decode) option.

For example:

sudo dmesg -x
Using the decode option in dmesg.

In the example above, each line is prepended with the appropriate facility and log level.

Read dmesg Log File

Each time the system boots up, the messages from the kernel ring buffer are stored in the /var/log/dmesg file. The dmesg command shows the log file contents. If you have issues using the dmesg command, open the log file in a text editor to view the contents.

Note: Read our tutorial for more information on Linux log files and how to read them.

In the example below, we use the cat command to view the log file and pipe it into grep to search for a particular string occurring in the log:

cat dmesg | grep amd
Reading the dmesg log file using the cat command.

The command outputs all amd string instances in the log file.

Check for a CD Drive

Check if a remote machine is equipped with a CD drive by inspecting the buffer message log. For example, the following command shows all messages about CD devices initialized on startup:

sudo dmesg | grep -iE 'cdrom|dvd|cd/rw|cd-rom'
Determining device types

The results display information about the available CD-ROM drives, including the virtual CD-ROM drive on this machine.

Remove sudo Requirement

Removing the requirement for superuser privileges allows any user to run dmesg and view kernel ring buffer messages. Run the following command to remove the sudo requirement:

sudo sysctl -w kernel.dmesg_restrict=0
Remove the sudo requirement

After setting the restrictions to 0, any user on the system can run dmesg.

Conclusion

This guide explained how to use the Linux dmesg command to view and control the kernel ring buffer. The utility is convenient when troubleshooting kernel or hardware issues.

For further reading, we recommend our tutorial on updating the Linux kernel in Ubuntu or checking the Kernel version in Linux.

Was this article helpful?
YesNo
Bosko Marijan
Having worked as an educator and content writer, combined with his lifelong passion for all things high-tech, Bosko strives to simplify intricate concepts and make them user-friendly. That has led him to technical writing at PhoenixNAP, where he continues his mission of spreading knowledge.
Next you should read
How to View Apache Access & Error Logs
January 7, 2019

Apache is part of the LAMP stack of software for Linux (Linux, Apache, MySQL, PHP). Learn how to view the Apache access and error logs.
Read more
How to Use the who Command in Linux
February 25, 2021

This tutorial provides examples for the use of the who command along with its options.
Read more
Linux cut Command Explained
November 29, 2021

The cut command allows you to extract information from files or piped data. This tutorial shows how to use the cut command and its options.
Read more
How to Use Linux nohup Command
December 16, 2021

Learn how to use the nohup command to continue running commands and processes in Linux even after the shell closes.
Read more