dmesg – The Low-Level Kernel Logs Utility

Introduction

The kernel ring buffer

‘dmesg‘ is the low-level kernel logs utility in Linux. Before we’ll explain how to use this utility, we must first understand what it does. The ‘dmesg‘ utility gives the user the ability to read kernel initialization logs out of the ring buffer. The kernel ring buffer is a special, fixed-size location in the system RAM, which is reserved for system-critical kernel logs during system boot and afterwards. On each system boot, the kernel initializes itself and starts processes like probing for hardware, loading drivers and etc. Upon subsequent reboots, the ring buffer location is flushed and new logs are written. Also, since it is fixed-size, it operates as FIFO (First In First Out); newer logs may (and will) overwrite older logs.

Usage

The following demonstation is performed on a machine running Red Hat Enterprise Linux 9.7, with kernel version 5.14.0

dmesg logs utility

To view the kernel ring buffer logs, we use the ‘dmesg’ utility. This utility is practically universal to all Linux distributions, and the commands will be the same in each one.

Using ‘dmesg | less‘, we can see the starting logs of our ring buffer with system information the kernel probed for:

[root@localhost ~]# dmesg | less
[    0.000000] Linux version 5.14.0-611.54.1.el9_7.x86_64 (mockbuild@x86-64-03.build.eng.rdu2.redhat.com) (gcc (GCC) 11.5.0 2
0240719 (Red Hat 11.5.0-11), GNU ld version 2.35.2-67.el9_7.1) #1 SMP PREEMPT_DYNAMIC Sat May 2 08:58:52 EDT 2026
[    0.000000] The list of certified hardware and cloud instances for Red Hat Enterprise Linux 9 can be viewed at the Red Hat
 Ecosystem Catalog, https://catalog.redhat.com.
[    0.000000] Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-5.14.0-611.54.1.el9_7.x86_64 root=/dev/mapper/rhel-root ro crash
kernel=1G-2G:192M,2G-64G:256M,64G-:512M resume=/dev/mapper/rhel-swap rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet
[    0.000000] BIOS-provided physical RAM map:
[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[    0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000bffd9fff] usable
[    0.000000] BIOS-e820: [mem 0x00000000bffda000-0x00000000bfffffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000023fffffff] usable
[    0.000000] NX (Execute Disable) protection: active
[    0.000000] APIC: Static calls initialized
[    0.000000] SMBIOS 2.8 present.
[    0.000000] DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
[    0.000000] Hypervisor detected: KVM
...
[    0.048668] CPU topo: Max. logical packages:   1
[    0.048670] CPU topo: Max. logical dies:       1
[    0.048671] CPU topo: Max. dies per package:   1
[    0.048683] CPU topo: Max. threads per core:   1
[    0.048685] CPU topo: Num. cores per package:     4
[    0.048686] CPU topo: Num. threads per package:   4
[    0.048688] CPU topo: Allowing 4 present CPUs plus 0 hotplug CPUs
...

The fields represent:

[second since last boot] <which kernel part of speaking>: <the log message>

By using output manipulation utilities such as ‘grep’, we can filter out for any messages based on search criteria:

[root@localhost ~]# dmesg | grep -i 'usb'
[    0.573914] ACPI: bus type USB registered
[    0.573994] usbcore: registered new interface driver usbfs
[    0.574036] usbcore: registered new interface driver hub
[    0.574052] usbcore: registered new device driver usb
[    2.461576] uhci_hcd 0000:00:01.2: new USB bus registered, assigned bus number 1
[    2.462253] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001, bcdDevice= 5.14
[    2.462260] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    2.462268] usb usb1: Product: UHCI Host Controller
[    2.462275] usb usb1: Manufacturer: Linux 5.14.0-611.54.1.el9_7.x86_64 uhci_hcd
[    2.462281] usb usb1: SerialNumber: 0000:00:01.2
[    2.462613] hub 1-0:1.0: USB hub found
[    2.463153] usbcore: registered new interface driver usbserial_generic
[    2.463171] usbserial: USB Serial support registered for generic
[    2.471650] usbcore: registered new interface driver usbhid
[    2.471653] usbhid: USB HID core driver
[    2.682961] usb 1-1: new full-speed USB device number 2 using uhci_hcd
[    2.852989] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00
[    2.853000] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10
[    2.853005] usb 1-1: Product: QEMU USB Tablet
[    2.853009] usb 1-1: Manufacturer: QEMU
[    2.853012] usb 1-1: SerialNumber: 28754-0000:00:01.2-1
[    2.862105] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:01.2/usb1/1-1/1-1:1.0/0003:0627:0001.0001/input/input5
[    2.862590] hid-generic 0003:0627:0001.0001: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:01.2-1/input0

[root@localhost ~]# dmesg | grep -iE 'error|fail'
[    0.459187] ACPI: _OSC evaluation for CPUs failed, trying _PDC
[    0.471856] acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended configuration space under this bridge

The utility also shows logs from current operations:

[root@localhost ~]# dmesg | tail -n 5
[   26.052238] block dm-0: the capability attribute has been deprecated.
[   52.722182] rfkill: input handler enabled
[   57.561382] ISO 9660 Extensions: Microsoft Joliet Level 3
[   57.590135] ISO 9660 Extensions: RRIP_1991A
[   58.111479] rfkill: input handler disabled

[root@localhost ~]# mount /dev/nonexistent /mnt
mount: /mnt: special device /dev/nonexistent does not exist.

[root@localhost ~]# dmesg tail -n 6
[   26.052238] block dm-0: the capability attribute has been deprecated.
[   52.722182] rfkill: input handler enabled
[   57.561382] ISO 9660 Extensions: Microsoft Joliet Level 3
[   57.590135] ISO 9660 Extensions: RRIP_1991A
[   58.111479] rfkill: input handler disabled
[ 2381.968783] /dev/nonexistent: Can't lookup blockdev

More useful flags for the ‘dmesg’ command are ‘-T’ and ‘-w’. ‘-T‘ converts the timestamp from “elapsed time from boot in seconds” to a time & date format (similar to the ‘date‘ command). The ‘-w‘ flag lets you attach your terminal for a live view of new messages:

[root@localhost ~]# dmesg -wT | tail -n 6
[Sun May 10 12:31:57 2026] block dm-0: the capability attribute has been deprecated.
[Sun May 10 12:32:23 2026] rfkill: input handler enabled
[Sun May 10 12:32:28 2026] ISO 9660 Extensions: Microsoft Joliet Level 3
[Sun May 10 12:32:28 2026] ISO 9660 Extensions: RRIP_1991A
[Sun May 10 12:32:29 2026] rfkill: input handler disabled
[Sun May 10 13:11:12 2026] /dev/nonexistent: Can't lookup blockdev

journalctl logs utility

As we’ve stated before, the kernel ring buffer gets wiped on each new boot. Therefore, there is no log persistentcy across reboots. If the OS boots, we can utilize the ‘journald‘ CLI ‘journalctl‘ to view dmesg logs from previous boots with the ‘-b -<n>’ flags.

[root@localhost ~]# sed -i 's/#Storage=auto/Storage=persistent/g' /etc/systemd/journald.conf
[root@localhost ~]# systemctl restart systemd-journald
[root@localhost ~]# journalctl --flush
[root@localhost ~]# reboot

[root@localhost ~]# journalctl -k --no-pager | tail -n 5
May 10 14:44:28 localhost kernel: RPC: Registered tcp-with-tls transport module.
May 10 14:44:28 localhost kernel: RPC: Registered tcp NFSv4.1 backchannel transport module.
May 10 14:44:29 localhost kernel: NET: Registered PF_QIPCRTR protocol family
May 10 14:44:34 localhost kernel: block dm-0: the capability attribute has been deprecated.
May 10 14:44:38 localhost kernel: rfkill: input handler disabled

[root@localhost ~]# journalctl -k -b -1 --no-pager | tail -n 5
May 10 14:44:02 localhost kernel: audit: type=1131 audit(1778413442.188:227): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-reboot comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
May 10 14:44:02 localhost kernel: audit: type=1334 audit(1778413442.192:228): prog-id=38 op=UNLOAD
May 10 14:44:02 localhost kernel: audit: type=1334 audit(1778413442.192:229): prog-id=37 op=UNLOAD
May 10 14:44:02 localhost systemd-shutdown[1]: Syncing filesystems and block devices.
May 10 14:44:02 localhost systemd-shutdown[1]: Sending SIGTERM to remaining processes...

Note that this method only works if the system succesfully boots and systemd can be initialized. Otherwise, we will have to use the emergency shell in order to view dmesg logs.

Synopsis

The ‘dmesg’ utility helps us understand how the kernel interacts with the hardware in our machines. It helps us locate problematic components, and provides a logging mechanism for all low-level operations the kernel does. For all the options dmesg provides, you can view the manual page here.

Want to learn more? Check out our other guides on different topics, making your Red Hat Enterprise Linux administration easier to do.