ISO27001:2013
Certified Supplier

FIND OUT MORE

We're an ISO27001:2013 Certified Supplier

blog-post-featured-image

When the Linux kernel is booting, initially there is no system logging facility, and that means that kernel messages could potentially be lost. The kernel solves this problem by writing those initial messages to the kernel ring buffer. A ring buffer is a fixed size area of memory that works on a “First In, First Out” (“FIFO”) basis. In other words, once the buffer is full, the next message will overwrite the oldest.

Under systemd

Once the system logger is available, it will log any kernel messages in a similar way to other log messages. Before the advent of systemd, those messages were typically written to /var/log/dmesg, but systemd will handle them using journalctl.

To look at the boot time kernel messages under systemd, use the journalctl command:

When examining the kernel messages using journalctl, all the usual facilities (filtering, paging, formatting, etc) are available.

dmesg

Regardless of whether systemd is being used, the kernel ring buffer may be examined with the dmesg command:

The number at the start of the line is the number of seconds since the system booted: interesting, maybe, but not particularly helpful. The -T switch to dmesg seems to be relatively unknown, but it changes the timestamp to the local time (long lines trimmed for readability here):

Making dmesg More Readable

There is a -H (“human”) switch to dmesg that adds more readable date and time information as well as adding colour to the output and paging it, but the date/time format that it uses by default is unusual:

That can be changed by specifying the time format:

Personally, I prefer using less to manage the paging, -T to handle the formatting, and with some care we can preserve the coloured output, too:

dmesg output

Bonus Tip

The more recent versions of dmesg support a -w switch that prints the kernel ring buffer and then waits. When more data is written to the ring buffer, it’s printed on the screen in a similar way to how tail -f works. That switch appears to be quite a well-kept secret, too.

Try this:

Was This Linux Tip Helpful?

Let us know in the comments below.

Leave a Reply

Your email address will not be published. Required fields are marked *