Skip to content

dmesg Command Cheat Sheet

dmesg (diagnostic message) displays the messages from the kernel ring buffer. It is the primary tool for diagnosing hardware failures, device driver issues, and boot-time errors.

Synopsis

dmesg [options]

Basic Usage

View All Kernel Messages

dmesg
(This can output thousands of lines. Pipe to less to navigate: dmesg | less)

Real-time Monitoring (--follow)

Wait for new messages. This is incredibly useful when plugging in new hardware (like USB drives) to see how the kernel recognizes it.

dmesg -w
# or
dmesg --follow

Timestamps

Human Readable Timestamps (-T)

By default, dmesg shows seconds since boot (e.g., [ 0.000000]). Use -T to convert this to complete warnings dates.

dmesg -T
# Output: [Sat Feb 14 12:00:00 2026] ...

Note: Timestamps are calculated based on uptime. If the system was suspended, they might be inaccurate.

Time Delta (-d)

Show the time delta between messages, useful for profiling boot speed.

dmesg -d

Filtering Output

Filter by Facility (-f)

Isolate messages from specific subsystems (facilities). Common facilities: kern, user, mail, daemon, auth, syslog, lpr, news.

# Show only daemon messages
dmesg -f daemon

Filter by Log Level (-l)

Filter by urgency level. Levels: emerg, alert, crit, err, warn, notice, info, debug.

# Show only errors and warnings
dmesg -l err,warn

# Show highly critical alerts only
dmesg -l crit,alert,emerg

Search with grep

The most common way to find specific device info.

# USB devices
dmesg | grep -i usb

# Hard drives / SSDs
dmesg | grep -i sda
dmesg | grep -i nvme

# Memory errors
dmesg | grep -i error
dmesg | grep -i segfault

Managing the Buffer

Clear the Buffer (-C)

Clears the ring buffer. Requires root privileges. Use this to start fresh before triggering an event you want to debug.

sudo dmesg -C

Read and Clear (-c)

Prints the contents and then clears them.

sudo dmesg -c

Advanced Options

User vs Kernel Messages

  • -u: Show userspace messages.
  • -k: Show kernel messages.
dmesg -k

Color Output (-L)

Colorize the output for better readability (default on most modern distros).

dmesg -L

Decoding "OOM Killer"

When Linux runs out of RAM, the Out-Of-Memory (OOM) killer sacrifices a process. Find out which one:

dmesg -T | grep -i "killed process"

Persistent Logs (journalctl)

On systemd systems, dmesg data is ephemeral (lost on reboot). For historical analysis, use journalctl.

# Current boot kernel logs (equivalent to dmesg)
journalctl -k

# Previous boot kernel logs
journalctl -k -b -1

# Follow live
journalctl -k -f

Practical Troubleshooting Scenarios

1. Diagnosing USB Connection

  1. Run dmesg -w
  2. Plug in the USB device.
  3. Watch for lines like [ sdb ] Attached SCSI removable disk.

2. Investigating Segfaults

If a program crashes simply saying "Segmentation fault", dmesg often logs the instruction pointer and memory address.

dmesg | tail | grep segfault

See if your ethernet cable was unplugged or re-negotiated speed.

dmesg | grep -i eth0

Exit Status

Code Meaning
0 Success
1 Error (usually permission denied dmesg: read kernel buffer failed)

Notes

  • Permissions: Modern distributions (like Debian/Ubuntu) restrict dmesg access to root users by default (kernel.dmesg_restrict=1). You may need sudo dmesg.
  • Buffer Size: The ring buffer has a fixed size. Heavy logging can push old messages out (dmesg rotates).