dmesg — Read the Kernel Ring Buffer and Diagnose Hardware Issues

dmesg prints the kernel ring buffer – the bounded memory region where the Linux kernel records messages about hardware detection, driver initialisation, USB events, disk errors and the OOM killer. When a device isn't recognised, the system stalls intermittently, or a process is killed for no obvious reason, dmesg is usually the first place to look. On modern distributions the buffer is often readable only with sudo for security reasons (kernel.dmesg_restrict). This guide shows you how to format messages legibly, filter them precisely and watch them live.

Basic Usage

dmesg — Show all kernel messages from the ring buffer.

dmesg

dmesg | less — Page through kernel messages.

dmesg | less

dmesg | tail -30 — Show the last 30 kernel messages.

dmesg | tail -30

sudo dmesg — Show kernel messages (may require root on some systems).

sudo dmesg

Timestamps & Formatting

dmesg -T — Show human-readable timestamps instead of seconds since boot.

dmesg -T

dmesg -t — Do not print timestamps at all.

dmesg -t

dmesg --time-format iso — Show timestamps in ISO 8601 format.

dmesg --time-format iso

dmesg -x — Decode facility and level to readable prefixes.

dmesg -x

dmesg --color=always — Force colorized output (useful when piping).

dmesg --color=always | less -R

dmesg -H — Human-readable output with color and pager.

dmesg -H

Filtering by Level

dmesg -l err — Show only error messages.

dmesg -l err

dmesg -l warn — Show only warning messages.

dmesg -l warn

dmesg -l crit — Show only critical messages.

dmesg -l crit

dmesg -l emerg — Show only emergency messages (system is unusable).

dmesg -l emerg

dmesg -l info — Show only informational messages.

dmesg -l info

dmesg -l err,warn — Show errors and warnings combined.

dmesg -l err,warn

dmesg -l err,crit,alert,emerg — Show all serious messages.

dmesg -l err,crit,alert,emerg

Filtering by Facility

dmesg -f kern — Show only kernel messages.

dmesg -f kern

dmesg -f daemon — Show only daemon messages.

dmesg -f daemon

dmesg -f user — Show only user-space messages.

dmesg -f user

dmesg -f syslog — Show only syslog messages.

dmesg -f syslog

Following & Clearing

dmesg -w — Follow/watch mode — continuously print new kernel messages (like tail -f).

sudo dmesg -w

dmesg -W — Follow and wait — only show new messages (skip existing buffer).

sudo dmesg -W

dmesg -c — Print and clear the ring buffer. Requires root.

sudo dmesg -c

dmesg -C — Clear the ring buffer without printing. Requires root.

sudo dmesg -C

dmesg -D — Disable printing messages to the console.

sudo dmesg -D

dmesg -E — Enable printing messages to the console.

sudo dmesg -E

Searching for Specific Events

dmesg | grep -i error — Search for error messages (case-insensitive).

dmesg | grep -i error

dmesg | grep -i 'usb' — Show USB-related kernel messages.

dmesg | grep -i 'usb'

dmesg | grep -i 'eth\|ens\|enp' — Show network interface-related messages.

dmesg | grep -i 'eth\|ens\|enp'

dmesg | grep -i 'sd[a-z]\|nvme' — Show disk/storage device messages.

dmesg | grep -i 'sd[a-z]\|nvme'

dmesg | grep -i 'oom\|out of memory' — Check for out-of-memory killer events.

dmesg | grep -i 'oom\|out of memory'

dmesg | grep -i 'segfault\|general protection' — Look for segmentation faults and protection errors.

dmesg | grep -i 'segfault\|general protection'

dmesg | grep -i 'firmware' — Show firmware loading messages.

dmesg | grep -i 'firmware'

Common Patterns

dmesg -T -l err,warn — Show errors and warnings with human-readable timestamps.

dmesg -T -l err,warn

dmesg -T | tail -50 — Show the 50 most recent kernel messages with timestamps.

dmesg -T | tail -50

dmesg -Tw — Follow kernel messages with human-readable timestamps.

sudo dmesg -Tw

dmesg --since '1 hour ago' — Show messages from the last hour (requires recent dmesg).

dmesg --since '1 hour ago'

dmesg --until '2024-01-01 12:00' — Show messages until a specific time.

dmesg --until '2024-01-01 12:00'

dmesg -T > dmesg_$(date +%Y%m%d).log — Save kernel messages with timestamps to a dated log file.

dmesg -T > dmesg_$(date +%Y%m%d).log

Conclusion

dmesg is a read-only command and therefore largely harmless – the sole exception is dmesg -C, which clears the ring buffer irreversibly and destroys forensic evidence in the process. For diagnostics it pays to make messages legible with -T and boil them down to what matters with -l err,warn; dmesg -w follows events live, for example when you plug in a USB device. On systems with kernel.dmesg_restrict=1 you'll need sudo. In substance dmesg overlaps heavily with journalctl -k, which keeps the same kernel messages persistently and across reboots – often the better choice for long-term analysis.