dmesg Command in Linux: Read and Filter Kernel Messages

The Linux kernel writes messages to the kernel ring buffer throughout the boot process and while the system is running. These messages cover hardware detection, driver initialization, and system events.

The ring buffer is a fixed-size circular buffer in physical memory. When it fills up, the oldest entries are overwritten. On long-running systems, early boot messages may no longer be present.

The dmesg command reads and displays the contents of this buffer. It is the primary tool for examining boot events and diagnosing hardware and driver issues.

How to Use the dmesg Command in Linux

The syntax is:

bashdmesg [OPTIONS]

Run without options to print all ring buffer messages:

bashdmesg

On many modern systems, non-root users are blocked from reading the buffer. The output will return: dmesg: read kernel buffer failed: Operation not permitted

This restriction is controlled by the kernel.dmesg_restrict kernel parameter. A value of 1 blocks non-root access. To allow it:

bashsudo sysctl -w kernel.dmesg_restrict=0

Or simply prefix with sudo when needed: sudo dmesg.

dmesg reads kernel messages from the /dev/kmsg character device on kernels 3.5 and later. The older /proc/kmsg interface can only be opened by one process at a time. If syslog is running and holds it open, reading /proc/kmsg with cat or less will hang.

The output is usually long. To paginate it with colors preserved:

bashdmesg --color=always | less

The --color=always flag is necessary because dmesg disables color output when it detects the output is not a terminal.

To search for specific messages, pipe through grep:

bashdmesg | grep -i usbdmesg | grep -i error

Format and Watch the Output

Human-readable output with -H automatically pipes the output through a pager. No need to pipe manually to less:

bashdmesg -H

Human-readable timestamps with -T convert the raw seconds-since-boot values into actual date and time strings:

bashdmesg -T

For finer timestamp control, --time-format accepts: ctime, reltime, delta, notime, or iso. The delta format shows how much time has passed since the previous message — useful for spotting slow initialization steps:

bashdmesg --time-format=delta

Combine -H and -T for paginated output with readable timestamps:

bashdmesg -H -T

Watch in real time with -w. New messages appear as the kernel logs them, similar to tail -f for regular log files:

bashdmesg -w

Filter by Facility and Log Level, and Clear the Buffer

Filter by log level with -l. Log levels run from most to least severe: emerg, alert, crit, err, warn, notice, info, debug.

To show only errors and critical messages:

bashdmesg -l err,crit

To include warnings as well:

bashdmesg -l warn,err,crit

Filter by facility with -f. Facilities identify the source of the message: kern, user, daemon, auth, mail, syslog, lpr, news.

To show only kernel and daemon messages:

bashdmesg -f kern,daemon

Clearing the ring buffer requires root privileges. Two options handle this differently:

• -C (uppercase) – clears the buffer without printing anything
• -c (lowercase) – prints the buffer contents first, then clears it

Before clearing, save the output to a file:

bashdmesg > dmesg_backup.txtsudo dmesg -C

dmesg vs journalctl. dmesg shows only what is in the kernel ring buffer, hardware events, driver messages, and boot output. journalctl shows the full systemd journal, which includes kernel messages alongside systemd service logs and application output.

Use dmesg -H -T for a readable view, -l err,crit to focus on problems, and -w to watch for new events in real time. Save the buffer to a file before clearing it with -C. Leave a comment below if you run into any issues.