dmesg Command in Linux: Read and Filter Kernel Messages

The Linux kernel is the core of the operating system that controls access to the system resources, such as CPU, I/O devices, physical memory, and file systems. The kernel writes various messages to the kernel ring buffer during the boot process, and when the system is running. These messages include various information about the operation of the system.

The kernel ring buffer is a portion of the physical memory that holds the kernel’s log messages. It has a fixed size, which means once the buffer is full, the older log records are overwritten.

The dmesg command-line utility is used to print and control the kernel ring buffer in Linux and other Unix-like operating systems. It is useful for examining kernel boot messages and debugging hardware related issues.

In this tutorial, we will cover the basics of the dmesg command.

Using the dmesg Command #

The syntax for the dmesg command is as follows:

dmesg [OPTIONS]

When invoked without any options, dmesg writes all messages from the kernel ring buffer to the standard output:

dmesg

On many modern systems, access to dmesg is restricted for non-root users. In that case, running dmesg returns an error such as:

dmesg: read kernel buffer failed: Operation not permitted

The kernel parameter kernel.dmesg_restrict specifies whether unprivileged users can use dmesg to view messages from the kernel’s log buffer. To remove the restrictions, set it to zero:

sudo sysctl -w kernel.dmesg_restrict=0

Usually, the output contains a lot of lines of information, so only the last part of the output is visible. To see one page at a time, pipe the output to a pager utility such as less or more:

dmesg --color=always | less

The --color=always is used to preserve the colored output.

If you want to filter the buffer messages, use grep . For example, to view only the USB related messages, you would type:

dmesg | grep -i usb

dmesg reads kernel messages from the /dev/kmsg character device (kernels 3.5 and later). The older /proc/kmsg interface is still present but can only be opened by one process at a time — if syslog is running and you try to read it with cat or less , the command will hang.

Some systems also write boot-time kernel messages to a log file such as /var/log/dmesg, so you may be able to inspect that file as well:

cat /var/log/dmesg

Formatting dmesg Output #

The dmesg command provides a number of options that help you format and filter the output.

One of the most used options of dmesg is -H (--human), which enables the human-readable output. This option pipes the command output into a pager:

dmesg -H

To print human-readable timestamps use the -T (--ctime) option:

dmesg -T

[Mon Oct 14 14:38:04 2019] IPv6: ADDRCONF(NETDEV_CHANGE): wlp1s0: link becomes ready

The timestamp format can also be set using the --time-format <format> option, which can be ctime, reltime, delta, notime, or iso. For example to use the delta format you would type:

dmesg --time-format=delta

You can also combine two or more options:

dmesg -H -T

To watch the output of the dmesg command in real-time use the -w (--follow) option:

dmesg --follow

Filtering dmesg Output #

You can restrict the dmesg output to given facilities and levels.

The facility represents the process that created the message. dmesg supports the following log facilities:

• kern - kernel messages
• user - user-level messages
• mail - mail system
• daemon - system daemons
• auth - security/authorization messages
• syslog - internal syslogd messages
• lpr - line printer subsystem
• news - network news subsystem

The -f (--facility <list>) option allows you to limit the output to specific facilities. The option accepts one or more comma-separated facilities.

For example, to display only the kernel and system daemons messages you would use:

dmesg -f kern,daemon

Each log message is associated with a log level that shows the importance of the message. dmesg supports the following log levels:

• emerg - system is unusable
• alert - action must be taken immediately
• crit - critical conditions
• err - error conditions
• warn - warning conditions
• notice - normal but significant condition
• info - informational
• debug - debug-level messages

The -l (--level <list>) option restricts the output to defined levels. The option accepts one or more comma-separated levels.

The following command displays only the error and critical messages:

dmesg -l err,crit

Clearing the Ring Buffer #

The -C (--clear) option allows you to clear the ring buffer:

sudo dmesg -C

Only root or users with sudo privileges can clear the buffer.

To print the buffer contents before clearing use the -c (--read-clear) option:

sudo dmesg -c

If you want to save the current dmesg logs in a file before clearing it, redirect the output to a file:

dmesg > dmesg_messages

Quick Reference #

FAQ #

How do I search dmesg output for a specific device or error?
Pipe dmesg through grep with the -i flag for case-insensitive matching. For example, dmesg | grep -i "error" shows all error-related messages, and dmesg | grep -i eth0 shows messages for a specific network interface.

Why do I get “Operation not permitted” when running dmesg?
The system has kernel.dmesg_restrict set to 1, which prevents non-root users from reading the kernel buffer. Run sudo dmesg to bypass the restriction, or permanently allow it with sudo sysctl -w kernel.dmesg_restrict=0.

How do I make dmesg timestamps readable?
Run dmesg -T to convert the raw seconds-since-boot timestamps into human-readable date and time strings. Combine with -H for paginated output: dmesg -H -T.

What is the difference between dmesg and journalctl?
dmesg shows only kernel ring buffer messages — hardware events, driver messages, and boot-time output. journalctl shows logs from the systemd journal, which includes kernel messages as well as systemd service logs and application output.

Conclusion #

The dmesg command allows you to view and control the kernel ring buffer. It is most useful when troubleshooting hardware, driver, and boot issues. For viewing systemd service and application logs, use the journalctl command. Type man dmesg in your terminal for information about all available options.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page