s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

dmesg

Show the kernel messages (the kernel ring buffer): hardware found, drivers loaded, disk and memory errors.

Level
RHCSA exam
Group
Kernel and hardware
Needs root
For changes
Package
util-linux

What it does

The kernel writes its messages into a ring buffer in memory. dmesg prints it: from the first boot messages to new events, like a USB stick being plugged in or a disk error. Times are seconds since boot; -T makes them readable.

On RHEL, normal users may be blocked (kernel.dmesg_restrict = 1); root can always read it. journalctl -k shows the same messages and also those of earlier boots.

How to write it

dmesg [OPTION]...

Options 30

Most used

Filter

-l, --level LIST
Only these levels: emerg, alert, crit, err, warn, notice, info, debug.
-f, --facility LIST
Only these facilities: kern, user, daemon …
-k, --kernel
Only kernel messages.
-u, --userspace
Only user-space messages.
--since TIME, --until TIME
Only messages in this time window.

Time and format

-T, --ctime
Human-readable time stamps.
-H, --human
Human output with colors and a pager.
-e, --reltime
Local time and time difference.
-d, --show-delta
Time since the previous message.
-t, --notime
No time stamps.
--time-format FORMAT
ctime, notime, delta, reltime, iso, raw.
-x, --decode
Show facility and level as words.
-r, --raw
Raw messages with level prefixes.
-J, --json
JSON output.
-L, --color[=WHEN]
Colors.
-p, --force-prefix
Prefix every line of multi-line messages.
--noescape
Do not escape unprintable characters.
-P, --nopager
No pager.

Follow

-w, --follow
Wait for new messages (like tail -f).
-W, --follow-new
Only new messages.

Buffer

-c, --read-clear
Print and clear the buffer (root).
-C, --clear
Clear the buffer (root).
-s, --buffer-size SIZE
Buffer size to read.
-S, --syslog
Use the syslog interface instead of /dev/kmsg.
-F, --file FILE
Read from a file.

Console

-n, --console-level LEVEL
Messages up to this level go to the console.
-D, --console-off
Stop messages on the console.
-E, --console-on
Messages on the console again.
-h, --help
Show help.
-V, --version
Show the version.

Examples 11

$ run as a normal user# run as root (or with sudo)

  1. 1All kernel messages

    dmesg | less

    From the boot until now.

  2. 2Readable times

    dmesg -T | tail
[Sun Oct 25 10:31:07 2026] sd 2:0:0:0: [sdc] Attached SCSI removable disk

    When did it happen?

  3. 3Errors and warnings only

    dmesg -T --level=err,warn

    First check for hardware trouble.

  4. 4Watch live

    dmesg -wT

    Plug in a device and see the messages.

  5. 5Disk errors (I/O)

    dmesg -T | grep -iE 'i/o error|blk_update_request|ata[0-9].*error'

    A failing disk or cable.

  6. 6Memory killer

    dmesg -T | grep -i 'out of memory'

    Which process the OOM killer killed.

  7. 7Find the device name of a new USB disk

    dmesg -T | tail -20 | grep -E 'sd[a-z]'

    Then use lsblk.

  8. 8Firewall drops logged by the kernel (security)

    dmesg -T | grep -i 'filter_'

    Shows packets that were logged and dropped.

  9. 9Segfaults of programs

    dmesg -T | grep -i segfault

    Crashes and possible exploit attempts.

  10. 10Check if users may read it (hardening)

    sysctl kernel.dmesg_restrict
kernel.dmesg_restrict = 1

    1 = only root (hides kernel addresses from attackers).

  11. 11Earlier boots

    journalctl -k -b -1

    dmesg only shows the current boot.

Exit codes

0 :: Done. 1 :: Error.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man dmesg

Open the man page (linux.die.net)man7.org