dmesg: Check Kernel Messages

Overview

dmesg displays the contents of the kernel ring buffer, which records messages generated by the kernel during boot, hardware initialization information, driver load status, and system errors. This buffer has a fixed size, and older messages may be overwritten as new messages arrive.

Key Features

Check system boot messages
Hardware detection and initialization information
Driver loading and error diagnosis
Kernel panic or crash information
Real-time kernel event monitoring (using some options)

Key Options

The dmesg command provides various options to control and filter kernel message output.

Output Formatting and Control

Message Filtering

Generated command:

Try combining the commands.

Description:

`dmesg` Executes the command.

Combine the above options to virtually execute commands with AI.

Usage Examples

Demonstrates various ways to use the dmesg command to check kernel messages and filter specific information.

Basic Kernel Message Output

dmesg

Outputs all contents of the kernel ring buffer.

Human-readable Output (Pager and Colors)

dmesg -H

Pipes the output to a pager and applies colors to improve scrolling and readability.

Output with Human-readable Timestamps

dmesg -T

Adds precise timestamps to messages, making it easy to determine when they occurred.

Filtering USB-related Messages

dmesg | grep -i usb

Combines dmesg output with grep to search only for USB device-related messages.

Outputting Only Error-level Messages

dmesg -l err

Filters and outputs only messages with the 'err' level from the kernel ring buffer.

Real-time Tracking of New Kernel Messages

dmesg -w

Outputs new kernel messages to the terminal immediately as they occur. Useful for system monitoring.

Tips & Precautions

dmesg is a powerful diagnostic tool, but it's important to learn efficient usage methods due to its extensive output.

Useful Combinations

dmesg is more powerful when combined with other text processing tools than when used alone.

`dmesg | less`: View output page by page when it's too long
`dmesg | grep -i 'error|fail'`: Search for error or failure messages
`dmesg -T | tail`: View the last few kernel messages
`dmesg | head -n 20`: View the first 20 lines (mostly initial boot messages)

Caution: Clearing the Buffer (-c)

The `-c` option clears the kernel ring buffer, which can lead to the loss of important logs. This option should only be used cautiously for debugging purposes when collecting new messages from a specific point in time.

Difference between dmesg and journalctl

dmesg shows only messages from the kernel ring buffer, whereas `journalctl` is a more comprehensive tool for managing and querying all system logs (kernel, services, applications, etc.) recorded in the systemd journal. In modern systems, `journalctl` may be preferred.