Use dmseg to check your Linux system’s kernel message buffer

The dmesg command displays the content of the kernel’s message buffer since the system’s most recent boot. It displays a lot of details on how the system is working and problems it might be running into that you won’t normally see. That can be a lot of data, but there are several tricks for paring it down.

For example, Even though the system queried below has only been up a little more than three days, it’s collected more than a thousand lines of data.

$ dmesg | wc -l
1034

If you type only dmesg, you will see all available data. Sudo access is not required. You can also pipe the output of dmesg to the more and less commands to scan through it or simply pipe the output to grep, but the command itself provides a lot of options for selecting the most relevant information from the file.

$ dmesg | grep NIC
[   21.483886] e1000e 0000:00:19.0 enp0s25: NIC Link is Up 100 Mbps Full Duplex, Flow Control: Rx/Tx
[   27.504178] e1000e 0000:00:19.0 enp0s25: NIC Link is Down

One of the things you will notice when you first start looking at dmesg output is the numbering on the left of every line. These are dates/times expressed in a seconds and nanoseconds since the last boot. They’ll look like this:

[   12.469099]
[274011.884318]

The first date representation above means the data was recorded roughly 12½ seconds since the system last booted. A calculation such as the one below that tells us that the second date shown was more than three days later. The number 86400 is the number of seconds in a single day.

$ echo "scale=2; 274011 / 86400" | bc
3.17

An easier way to view the date/time field is to use the -T or -H option which translate these fields into dates and times like those we are used to seeing.

$ dmesg -T | head -3
[Fri Dec  3 08:52:34 2021] microcode: microcode updated early to revision 0xa0b, date = 2010-09-28
[Fri Dec  3 08:52:34 2021] Linux version 5.15.4-101.fc34.x86_64 (mockbuild@bkernel02.iad2.fedoraproject.org) (gcc (GCC) 11.2.1 20210728 (Red Hat 11.2.1-1), GNU ld version 2.35.2-6.fc34) #1 SMP Tue Nov 23 18:58:50 UTC 2021
[Fri Dec  3 08:52:34 2021] Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-5.15.4-101.fc34.x86_64 root=UUID=a9e33237-9114-44ae-afd5-8ddb231d301f ro rootflags=subvol=root rhgb quiet
$ dmesg -H | head -4
[Dec 3 08:52] microcode: microcode updated early to revision 0xa0b, date = 2010-09-28
[  +0.000000] Linux version 5.15.4-101.fc34.x86_64 (mockbuild@bkernel02.iad2.fedoraproject.org) (gcc (GCC) 11.2.1 20210728 (Red Hat 11.2.1-1), GNU ld version 2.35.2-6.fc34) #1 SMP Tue Nov 23 18:58:50 UTC 2021
[  +0.000000] Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-5.15.4-101.fc34.x86_64 root=UUID=a9e33237-9114-44ae-afd5-8ddb231d301f ro rootflags=subvol=root rhgb quiet
[  +0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'

You can use commands like those shown below to pick out details related to RAM, hard disk, USB drive, and serial ports.

$ dmesg | grep -i memory
$ dmesg | grep -i dma
$ dmesg | grep -i usb
$ dmesg | grep -i tty

Using log facilities

You can select dmesg content based on the process that generated the messages. Supported log facilities include:

• kern – kernel messages
• user – random user-level messages
• mail – mail system
• daemon – system daemons
• auth – security/authorization messages
• syslog – messages generated internally by syslogd
• lpr – line printer subsystem
• news – network news subsystem

As you will see in the examples below, some commands will show no output because no related activity was logged.

Using kern

$ dmesg -f kern | head -2
[    0.000000] microcode: microcode updated early to revision 0xa0b, date = 2010-09-28
[    0.000000] Linux version 5.15.4-101.fc34.x86_64 (mockbuild@bkernel02.iad2.fedoraproject.org) (gcc (GCC) 11.2.1 20210728 (Red Hat 11.2.1-1), GNU ld version 2.35.2-6.fc34) #1 SMP Tue Nov 23 18:58:50 UTC 2021

Using user

$ dmesg -f user | head -2

Using mail

$ dmesg -f mail | head -2

Using daemon

$ dmesg -f daemon | head -2
[    1.772531] systemd[1]: systemd v248.9-1.fc34 running in system mode. (+PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified)
[    1.784315] systemd[1]: Detected architecture x86-64.

Using auth

$ dmesg -f auth | head -2

Using syslog

$ dmesg -f syslog | head -2
[    7.451957] systemd-journald[192]: Received SIGTERM from PID 1 (systemd).
[    9.575729] systemd-journald[499]: Received client request to flush runtime journal.

Using lpr

$ dmesg -f lpr | head -2

Using news

$ dmesg -f news | head -2

Using levels

The dmesg command also allows you to pull data by log levels. These include:

• emerg – system is unusable
• alert – action must be taken immediately
• crit – critical conditions
• err – error conditions
• warn – warning conditions
• notice – normal but significant condition
• info – informational
• debug – debug-level messages

Using emerg

$ dmesg -l emerg | head -2

Using alert

$ dmesg -l alert | head -2

Using crit

$ dmesg -l crit | head -2

Using err

$ dmesg -l err | head -2
[    6.580237] usb 2-2: device descriptor read/64, error -110
[    7.875161] sd 4:0:0:0: [sdc] No Caching mode page found

Using warn

$ dmesg -l warn | head -2
[    0.006843] ACPI BIOS Warning (bug): 32/64X length mismatch in FADT/Pm1aEventBlock: 32/8 (20210730/tbfadt-564)
[    0.006846] ACPI BIOS Warning (bug): 32/64X length mismatch in FADT/Pm1aControlBlock: 16/8 (20210730/tbfadt-564)

Using notice

$ dmesg -l notice | head -2
[    0.000000] Linux version 5.15.4-101.fc34.x86_64 (mockbuild@bkernel02.iad2.fedoraproject.org) (gcc (GCC) 11.2.1 20210728 (Red Hat 11.2.1-1), GNU ld version 2.35.2-6.fc34) #1 SMP Tue Nov 23 18:58:50 UTC 2021
[    0.157702] Kernel command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-5.15.4-101.fc34.x86_64 root=UUID=a9e33237-9114-44ae-afd5-8ddb231d301f ro rootflags=subvol=root rhgb quiet

Using info

$ dmesg -l info | head -2
[    0.000000] microcode: microcode updated early to revision 0xa0b, date = 2010-09-28
[    0.000000] Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-5.15.4-101.fc34.x86_64 root=UUID=a9e33237-9114-44ae-afd5-8ddb231d301f ro rootflags=subvol=root rhgb quiet

Using debug

$ dmesg -l debug | head -2
[    0.000888] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved
[    0.000891] e820: remove [mem 0x000a0000-0x000fffff] usable

Wrap-Up

The dmesg command provides lots of details on how your Linux system is operating and problems that you might not otherwise be aware of. It can also give you many insights about how your system works.