dmesg for kernel messages in Linux CLI - Commands & Configuration

Introduction

Sometimes your computer's hardware or system software has important messages about what is happening inside. The dmesg command shows these messages so you can understand if something is working or if there is a problem.

When your computer is not recognizing a new USB device and you want to see what the system says about it.

When you want to check if your hard drive or other hardware had any errors during startup.

When you want to see recent kernel messages after plugging in new hardware.

When troubleshooting why a device driver is not loading correctly.

When you want to monitor system messages related to hardware changes or errors.

Commands

This command shows all the kernel messages stored since the system started. It helps you see hardware and system events.

Terminal

dmesg

Expected Output

 [    0.000000] Initializing cgroup subsys cpuset

 [    0.000000] Initializing cgroup subsys cpu

 [    0.000000] Linux version 5.15.0-50-generic (buildd@lcy02-amd64-027) (gcc (Ubuntu 11.3.0-1ubuntu1) 11.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #56-Ubuntu SMP Wed May 18 15:29:35 UTC 2022

 [    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-5.15.0-50-generic root=UUID=1234abcd-56ef-7890-gh12-3456ijklmnop ro quiet splash

 [    0.000000] KERNEL supported cpus:

 [    0.000000]   Intel GenuineIntel

 [    0.000000]   AMD AuthenticAMD

 [    0.000000]   Hygon HygonGenuine

 [    0.000000]   Centaur CentaurHauls

 [    0.000000]   zhaoxin   Shanghai

 [    0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'

 [    0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'

 [    0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'

 [    0.000000] x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256

 [    0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format.

This command shows only the last 10 kernel messages. It helps you quickly see the most recent events without scrolling through everything.

Terminal

dmesg | tail -n 10

Expected Output

 [  123.456789] usb 1-1: new high-speed USB device number 4 using xhci_hcd

 [  123.567890] usb 1-1: New USB device found, idVendor=abcd, idProduct=1234

 [  123.567895] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3

 [  123.567899] usb 1-1: Product: USB Flash Drive

 [  123.567902] usb 1-1: Manufacturer: Generic

 [  123.567905] usb 1-1: SerialNumber: 1234567890AB

 [  123.568000] usb-storage 1-1:1.0: USB Mass Storage device detected

 [  123.568123] scsi host6: usb-storage 1-1:1.0

 [  124.567890] scsi 6:0:0:0: Direct-Access     Generic  Flash Disk       8.07 PQ: 0 ANSI: 6

 [  124.568000] sd 6:0:0:0: Attached scsi generic sg2 type 0

→

-n - Show only the last specified number of lines

This command shows kernel messages with human-readable timestamps and filters only messages related to USB devices. It helps you find USB events with clear time info.

Terminal

dmesg --ctime | grep usb

Expected Output

Thu Jun  1 12:34:56 2023 usb 1-1: new high-speed USB device number 4 using xhci_hcd

Thu Jun  1 12:34:56 2023 usb 1-1: New USB device found, idVendor=abcd, idProduct=1234

Thu Jun  1 12:34:56 2023 usb 1-1: Product: USB Flash Drive

Thu Jun  1 12:34:56 2023 usb-storage 1-1:1.0: USB Mass Storage device detected

→

--ctime - Show timestamps in human-readable date and time format

Key Concept

If you remember nothing else from this pattern, remember: dmesg shows system and hardware messages that help you understand what your computer is doing or if something is wrong.

Common Mistakes

Running dmesg without sudo and expecting to see all messages.

Some kernel messages require root permission to view, so you might miss important info.

Run dmesg with sudo (sudo dmesg) to see all kernel messages.

Not using filtering or tail commands and getting overwhelmed by too many messages.

The output can be very long and hard to read, making it difficult to find relevant info.

Use commands like 'dmesg | tail -n 10' or 'dmesg | grep keyword' to focus on recent or relevant messages.

Summary

Use 'dmesg' to view all kernel messages since system start.

Use 'dmesg | tail -n 10' to see the most recent kernel messages quickly.

Use 'dmesg --ctime | grep usb' to find USB-related messages with readable timestamps.

Practice

1. What is the primary purpose of the dmesg command in Linux?

easy

A. To display kernel messages and system events

B. To list all running processes

C. To show disk usage statistics

D. To edit system configuration files

Solution

1. Step 1: Understand the role of dmesg

   The dmesg command reads the kernel ring buffer, which contains messages about system events and hardware status.

2. Step 2: Compare with other options

   Options A, B, and C relate to file editing, process listing, and disk usage, which are unrelated to kernel messages.

3. Final Answer:

   To display kernel messages and system events -> Option A

4. Quick Check:

   Kernel messages = display with dmesg [OK]

Hint: dmesg always shows kernel logs, not processes or files [OK]

Common Mistakes:

• Confusing dmesg with ps or top commands
• Thinking dmesg edits files
• Assuming dmesg shows disk info

2. Which of the following is the correct syntax to display kernel messages with human-readable timestamps using dmesg?

easy

A. dmesg -r

B. dmesg --time

C. dmesg -T

D. dmesg -h

Solution

1. Step 1: Identify the option for readable timestamps

   The -T option in dmesg converts kernel timestamps to human-readable format.

2. Step 2: Verify other options

   -r reverses output order, --time is invalid, and -h shows help.

3. Final Answer:

   dmesg -T -> Option C

4. Quick Check:

   Readable time = -T option [OK]

Hint: Use -T for readable timestamps in dmesg output [OK]

Common Mistakes:

• Using -r instead of -T for timestamps
• Typing invalid options like --time
• Confusing -h (help) with timestamp option

3. What will be the output of the command dmesg | grep usb?

medium

A. All kernel messages containing the word 'usb'

B. Only USB device names without any messages

C. A list of all running USB processes

D. An error because grep cannot be used with dmesg

Solution

1. Step 1: Understand the pipe and grep usage

   The command pipes dmesg output to grep usb, filtering lines containing 'usb'.

2. Step 2: Interpret the filtered output

   This shows kernel messages related to USB devices or events, not just names or processes.

3. Final Answer:

   All kernel messages containing the word 'usb' -> Option A

4. Quick Check:

   dmesg | grep filters messages by keyword [OK]

Hint: Pipe dmesg to grep to filter messages by keyword [OK]

Common Mistakes:

• Thinking grep lists processes
• Expecting only device names without messages
• Assuming grep causes errors with dmesg

4. You run dmesg -T but get an error saying "dmesg: option requires an argument -- 'T'". What is the likely cause?

medium

A. You typed the command incorrectly; -T needs a filename

B. You used an older dmesg version that does not support -T

C. The kernel is not loaded, so dmesg fails

D. You need root permissions to use -T option

Solution

1. Step 1: Analyze the error message

   The error says the option -T requires an argument, which is unusual because -T normally needs none.

2. Step 2: Understand version compatibility

   Older versions of dmesg do not support -T, causing this error.

3. Final Answer:

   You used an older dmesg version that does not support -T -> Option B

4. Quick Check:

   Old dmesg versions lack -T support [OK]

Hint: Check dmesg version if -T option errors [OK]

Common Mistakes:

• Assuming -T needs a filename argument
• Thinking root permission is required for -T
• Blaming kernel load status for this error

5. You want to monitor new kernel messages related to network devices in real-time. Which command combination is best?

hard

A. dmesg --follow --filter=net

B. dmesg -T | grep net

C. dmesg | tail -n 10 | grep net

D. dmesg -w | grep net

Solution

1. Step 1: Identify real-time monitoring option

   The -w option makes dmesg wait and show new messages as they appear.

2. Step 2: Combine with grep for filtering

   Piping to grep net filters messages related to network devices.

3. Step 3: Evaluate other options

   -T shows timestamps but is not real-time; tail -n 10 shows only last 10 lines; --follow --filter=net is invalid syntax.

4. Final Answer:

   dmesg -w | grep net -> Option D

5. Quick Check:

   Real-time dmesg = -w with grep filter [OK]

Hint: Use dmesg -w for live kernel logs, pipe to grep to filter [OK]

Common Mistakes:

• Using -T for real-time (it only formats time)
• Using tail only shows past logs, not live
• Assuming --follow or --filter options exist