# dmesg — Read the Kernel Ring Buffer and Diagnose Hardware Issues > Practical guide to dmesg — read kernel messages about hardware, drivers and OOM events, follow them live, filter by level and format timestamps. Source: https://www.jpkc.com/db/en/cheatsheets/shell-system/dmesg/ dmesg prints the kernel ring buffer – the bounded memory region where the Linux kernel records messages about hardware detection, driver initialisation, USB events, disk errors and the OOM killer. When a device isn't recognised, the system stalls intermittently, or a process is killed for no obvious reason, dmesg is usually the first place to look. On modern distributions the buffer is often readable only with `sudo` for security reasons (`kernel.dmesg_restrict`). This guide shows you how to format messages legibly, filter them precisely and watch them live. ## Basic Usage `dmesg` — Show all kernel messages from the ring buffer. ```bash dmesg ``` `dmesg | less` — Page through kernel messages. ```bash dmesg | less ``` `dmesg | tail -30` — Show the last 30 kernel messages. ```bash dmesg | tail -30 ``` `sudo dmesg` — Show kernel messages (may require root on some systems). ```bash sudo dmesg ``` ## Timestamps & Formatting `dmesg -T` — Show human-readable timestamps instead of seconds since boot. ```bash dmesg -T ``` `dmesg -t` — Do not print timestamps at all. ```bash dmesg -t ``` `dmesg --time-format iso` — Show timestamps in ISO 8601 format. ```bash dmesg --time-format iso ``` `dmesg -x` — Decode facility and level to readable prefixes. ```bash dmesg -x ``` `dmesg --color=always` — Force colorized output (useful when piping). ```bash dmesg --color=always | less -R ``` `dmesg -H` — Human-readable output with color and pager. ```bash dmesg -H ``` ## Filtering by Level `dmesg -l err` — Show only error messages. ```bash dmesg -l err ``` `dmesg -l warn` — Show only warning messages. ```bash dmesg -l warn ``` `dmesg -l crit` — Show only critical messages. ```bash dmesg -l crit ``` `dmesg -l emerg` — Show only emergency messages (system is unusable). ```bash dmesg -l emerg ``` `dmesg -l info` — Show only informational messages. ```bash dmesg -l info ``` `dmesg -l err,warn` — Show errors and warnings combined. ```bash dmesg -l err,warn ``` `dmesg -l err,crit,alert,emerg` — Show all serious messages. ```bash dmesg -l err,crit,alert,emerg ``` ## Filtering by Facility `dmesg -f kern` — Show only kernel messages. ```bash dmesg -f kern ``` `dmesg -f daemon` — Show only daemon messages. ```bash dmesg -f daemon ``` `dmesg -f user` — Show only user-space messages. ```bash dmesg -f user ``` `dmesg -f syslog` — Show only syslog messages. ```bash dmesg -f syslog ``` ## Following & Clearing `dmesg -w` — Follow/watch mode — continuously print new kernel messages (like tail -f). ```bash sudo dmesg -w ``` `dmesg -W` — Follow and wait — only show new messages (skip existing buffer). ```bash sudo dmesg -W ``` `dmesg -c` — Print and clear the ring buffer. Requires root. ```bash sudo dmesg -c ``` `dmesg -C` — Clear the ring buffer without printing. Requires root. ```bash sudo dmesg -C ``` `dmesg -D` — Disable printing messages to the console. ```bash sudo dmesg -D ``` `dmesg -E` — Enable printing messages to the console. ```bash sudo dmesg -E ``` ## Searching for Specific Events `dmesg | grep -i error` — Search for error messages (case-insensitive). ```bash dmesg | grep -i error ``` `dmesg | grep -i 'usb'` — Show USB-related kernel messages. ```bash dmesg | grep -i 'usb' ``` `dmesg | grep -i 'eth\|ens\|enp'` — Show network interface-related messages. ```bash dmesg | grep -i 'eth\|ens\|enp' ``` `dmesg | grep -i 'sd[a-z]\|nvme'` — Show disk/storage device messages. ```bash dmesg | grep -i 'sd[a-z]\|nvme' ``` `dmesg | grep -i 'oom\|out of memory'` — Check for out-of-memory killer events. ```bash dmesg | grep -i 'oom\|out of memory' ``` `dmesg | grep -i 'segfault\|general protection'` — Look for segmentation faults and protection errors. ```bash dmesg | grep -i 'segfault\|general protection' ``` `dmesg | grep -i 'firmware'` — Show firmware loading messages. ```bash dmesg | grep -i 'firmware' ``` ## Common Patterns `dmesg -T -l err,warn` — Show errors and warnings with human-readable timestamps. ```bash dmesg -T -l err,warn ``` `dmesg -T | tail -50` — Show the 50 most recent kernel messages with timestamps. ```bash dmesg -T | tail -50 ``` `dmesg -Tw` — Follow kernel messages with human-readable timestamps. ```bash sudo dmesg -Tw ``` `dmesg --since '1 hour ago'` — Show messages from the last hour (requires recent dmesg). ```bash dmesg --since '1 hour ago' ``` `dmesg --until '2024-01-01 12:00'` — Show messages until a specific time. ```bash dmesg --until '2024-01-01 12:00' ``` `dmesg -T > dmesg_$(date +%Y%m%d).log` — Save kernel messages with timestamps to a dated log file. ```bash dmesg -T > dmesg_$(date +%Y%m%d).log ``` ## Conclusion dmesg is a read-only command and therefore largely harmless – the sole exception is `dmesg -C`, which clears the ring buffer irreversibly and destroys forensic evidence in the process. For diagnostics it pays to make messages legible with `-T` and boil them down to what matters with `-l err,warn`; `dmesg -w` follows events live, for example when you plug in a USB device. On systems with `kernel.dmesg_restrict=1` you'll need `sudo`. In substance dmesg overlaps heavily with `journalctl -k`, which keeps the same kernel messages persistently and across reboots – often the better choice for long-term analysis. ## Further Reading - [Wikipedia: dmesg](https://en.wikipedia.org/wiki/Dmesg) – background on the kernel ring buffer and the command - [Arch Wiki: General troubleshooting](https://wiki.archlinux.org/title/General_troubleshooting#Kernel) – using kernel logs to diagnose system problems ## Related Commands - [journalctl](https://www.jpkc.com/db/en/cheatsheets/shell-system/journalctl/) – query the systemd journal, including kernel messages via `journalctl -k` - [strace](https://www.jpkc.com/db/en/cheatsheets/shell-system/strace/) – trace a process's system calls when dmesg points to a problem - [lsof](https://www.jpkc.com/db/en/cheatsheets/shell-system/lsof/) – list open files and devices, complementing hardware diagnostics