Quick take: The dmesg command prints the kernel's ring buffer — boot messages, hardware detection, and driver output. Use dmesg -H for readable, paged output with human timestamps, and dmesg -w to watch new messages live.
Introduction
The dmesg command (display message) shows the kernel's ring buffer, a log of low-level events: hardware detection at boot, USB devices plugged in, disk errors, and driver messages. When a device is not recognised or behaving strangely, dmesg is where the kernel explains what happened.
Syntax
The basic syntax of the dmesg command is:
dmesg [OPTIONS]Common Options and Parameters
The most useful options and parameters for the dmesg command:
| Option | Description |
|---|---|
| -H | Human-readable, paged output with friendly timestamps. |
| -T | Show human-readable timestamps. |
| -w | Follow — print new messages as they arrive. |
| -l LEVEL | Filter by level (err, warn, info). |
| -f FACILITY | Filter by facility (kern, daemon). |
| --clear | Clear the ring buffer (needs root). |
| -x | Decode facility and level for each line. |
Practical Examples
Real dmesg commands you can run today:
# Read kernel messages (paged, readable)
dmesg -H
# Show human-readable timestamps
dmesg -T
# Watch new messages live
dmesg -w
# Show only errors
dmesg -l err
# See what happened when a USB was plugged in
dmesg -T | tail -20
# Filter for a device
dmesg | grep -i sdaTips and Best Practices
- Plug in a USB device, then run
dmesg -T | tailto see exactly how the kernel detected it and which device node it got. - On many systems reading dmesg now requires
sudodue to a security setting; prefix with sudo if you get a permission error. - For persistent, queryable kernel logs use
journalctl -k, which is the systemd equivalent of dmesg.
Final Thoughts
dmesg is the window into the kernel's own log — boot events, hardware detection, and driver messages that explain device problems. Use -H for readable output, -w to watch live, and grep for a specific device. For persistent kernel logs across reboots, journalctl -k picks up where dmesg's volatile buffer leaves off.
FAQ: dmesg Command in Linux
What does dmesg show?+
dmesg prints the kernel ring buffer — low-level messages about boot, hardware detection, USB and disk events, and driver activity. It is the first place to look when a device is not recognised or misbehaving.
How do I see new kernel messages live?+
Use dmesg -w (or dmesg --follow), which keeps printing new messages as they occur, similar to tail -f for kernel logs.
How do I get readable timestamps in dmesg?+
Use -T for human-readable timestamps or -H for a paged, friendly view. By default dmesg shows seconds since boot, which is harder to interpret.
Why does dmesg need sudo now?+
Many distributions restrict access to the kernel ring buffer for security (the kernel.dmesg_restrict setting), so reading it requires root. Prefix the command with sudo if you get a permission error.
What is the difference between dmesg and journalctl -k?+
dmesg reads the volatile kernel ring buffer, which is lost on reboot. journalctl -k shows the same kernel messages from the systemd journal, which can persist across reboots and be filtered by time.
Need help with Linux servers or infrastructure?
Work directly with Muhammad Irfan Aslam for Linux, Ubuntu, Docker, DevOps, cloud, CI/CD, or infrastructure support.
Hire Me for Support