Skip to content

dmesg — Viewing Linux Kernel Messages

dmesg (display message) is a Linux command used to view messages generated by the Linux kernel. These messages include information about system startup, hardware detection, device drivers, memory initialization, storage devices, network interfaces, USB devices, kernel warnings, and errors. The dmesg command is one of the most valuable troubleshooting tools for diagnosing hardware issues, boot problems, and kernel-related errors. Every Linux administrator, DevOps engineer, Cloud Architect, Platform Engineer, and Site Reliability Engineer (SRE) should understand how to use dmesg in production environments.

Learning Path

Linux Mastery → Module 12: Monitoring & Logs → Lesson 3

Difficulty: Beginner → Intermediate

Reading Time: 90 Minutes

Course Progress

Course: Linux Mastery

Module: Monitoring & Logs

Lesson: 3 of 10

What You'll Learn

After completing this lesson, you'll be able to:

  • Understand kernel messages
  • Use the dmesg command
  • Analyze system boot logs
  • Troubleshoot hardware detection
  • Investigate driver issues
  • Identify kernel errors
  • Filter kernel messages
  • Apply production troubleshooting techniques

Prerequisites

Complete:

  • Modules 1–11
  • Module 12 Lessons 1–2

Why Learn dmesg?

Imagine a new storage disk is connected to a Linux server.

Without dmesg:

Disk Not Visible

↓

Unknown Cause

↓

Manual Investigation

With dmesg:

Disk Connected

↓

Kernel Detects Device

↓

View Kernel Message

↓

Problem Identified

Kernel messages provide immediate insight into hardware and low-level system events.

What is dmesg?

dmesg displays the Linux kernel ring buffer.

The kernel records events such as:

  • System startup
  • Hardware detection
  • Device drivers
  • USB devices
  • Disk detection
  • Network interfaces
  • Kernel warnings
  • Kernel errors

These messages help diagnose problems that occur before user-space services start.

How dmesg Works

Hardware Event

↓

Linux Kernel

↓

Kernel Ring Buffer

↓

dmesg

↓

Administrator

View Kernel Messages

Display all kernel messages.

dmesg

The output may be lengthy on systems that have been running for some time.

View Recent Messages

Display the latest kernel messages.

dmesg | tail

Example:

USB Device Connected

↓

Detected Successfully

Human-Readable Timestamps

Display timestamps in a readable format.

dmesg -T

Example:

[Mon Aug 10 09:15:32 2026]

This option makes troubleshooting much easier than interpreting raw uptime-based timestamps.

Follow Kernel Messages

Monitor new kernel messages in real time.

dmesg -w

This is useful when:

  • Connecting USB devices
  • Inserting disks
  • Testing hardware
  • Monitoring driver behavior

Filter Error Messages

Display only errors.

dmesg --level=err

Display warnings.

dmesg --level=warn

Display multiple levels.

dmesg --level=err,warn

Search Kernel Messages

Search for USB devices.

dmesg | grep USB

Search for disks.

dmesg | grep sd

Search for network devices.

dmesg | grep eth

Or modern interface names.

dmesg | grep en

Storage Detection

When a disk is connected:

dmesg | grep sd

Example:

sdb

↓

New Disk Detected

Useful when adding storage to Linux servers.

USB Detection

Connect a USB drive.

Then run:

dmesg | tail

Example:

USB Mass Storage Device Detected

Network Interface Detection

View network-related messages.

dmesg | grep Ethernet

or

dmesg | grep en

Useful for troubleshooting NIC initialization.

Memory Information

View memory initialization.

dmesg | grep Memory

or

dmesg | grep RAM

CPU Information

Search CPU initialization.

dmesg | grep CPU

View Boot Messages

dmesg includes kernel messages generated during system startup.

Example:

Kernel Loaded

↓

Memory Initialized

↓

Drivers Loaded

↓

Devices Detected

Common Commands

Display messages.

dmesg

Readable timestamps.

dmesg -T

Follow messages.

dmesg -w

View errors.

dmesg --level=err

Search USB.

dmesg | grep USB

Real Production Examples

Check storage devices.

dmesg | grep sd

Investigate USB devices.

dmesg | grep USB

Monitor live events.

dmesg -w

Check kernel errors.

dmesg --level=err

Production Perspective

dmesg is widely used for:

  • Hardware troubleshooting
  • Server provisioning
  • Storage troubleshooting
  • Driver debugging
  • Boot failure analysis
  • Virtual machine diagnostics
  • Kubernetes node troubleshooting
  • Production incident response

It is often one of the first tools used when diagnosing hardware or kernel-related issues.

Hands-on Lab

Task 1

Display all kernel messages.

dmesg

Task 2

Display messages with readable timestamps.

dmesg -T

Task 3

View only the latest messages.

dmesg | tail

Task 4

Monitor kernel events in real time.

dmesg -w

Task 5

Search for USB devices.

dmesg | grep USB

Task 6

Search for storage devices.

dmesg | grep sd

Task 7

Display kernel errors.

dmesg --level=err

Task 8

Connect a USB device or attach a virtual disk and observe the new kernel messages using dmesg -w.

Command Deep Dive

Command Purpose Production Example
dmesg View kernel messages System diagnostics
dmesg -T Human-readable timestamps Incident analysis
dmesg -w Monitor kernel events Live hardware monitoring
dmesg --level=err Display kernel errors Troubleshooting
grep Search kernel messages Hardware detection
tail View latest events Quick diagnostics

Common dmesg Mistakes

Mistake Solution
Reading the entire output without filtering Use grep or --level
Ignoring kernel warnings Investigate warning messages
Assuming every message is an error Differentiate informational messages from failures
Looking only at application logs Review kernel messages during hardware issues
Forgetting readable timestamps Use dmesg -T

Production Troubleshooting Scenario

Scenario

A newly attached storage disk is not visible.

Investigation:

dmesg | tail

Output:

I/O Error

↓

Disk Initialization Failed

The administrator identifies a hardware or connection issue, replaces the faulty cable, reconnects the disk, and verifies successful detection using:

dmesg | grep sd

The storage device now appears correctly.

Best Practices

  • Check dmesg after hardware changes.
  • Use readable timestamps with -T.
  • Filter messages instead of reviewing the entire output.
  • Investigate kernel warnings and errors promptly.
  • Combine dmesg with journalctl for complete troubleshooting.
  • Save important kernel logs before rebooting when investigating incidents.
  • Review hardware initialization messages after system upgrades.

Common Mistakes

❌ Ignoring kernel warning messages.

✅ Always review kernel warning messages.

❌ Reviewing only application logs during hardware failures.

✅ Avoid this mistake: reviewing only application logs during hardware failures.

❌ Assuming missing hardware is always a configuration issue.

✅ Verify missing hardware is always a configuration issue instead of assuming it.

❌ Forgetting that the kernel ring buffer may change over time.

✅ Remember to that the kernel ring buffer may change over time.

❌ Using unfiltered output when targeted searches are more efficient.

✅ Avoid using unfiltered output when targeted searches are more efficient when a safer approach exists.

Interview Questions

Beginner

  1. What is dmesg?
  2. What type of information does dmesg display?
  3. Which command displays readable timestamps?
  4. How do you monitor kernel messages in real time?

Intermediate

  1. How do you display only kernel error messages?
  2. How would you verify whether Linux detected a newly attached disk?
  3. Why is dmesg useful for hardware troubleshooting?
  4. What is the kernel ring buffer?

Architect Level

  1. How would you troubleshoot a production server that fails to detect new hardware?
  2. How would you combine dmesg, journalctl, and syslog during an incident investigation?
  3. What kernel events would you monitor on Kubernetes worker nodes?

Summary

In this lesson, you learned:

  • Linux kernel messages
  • The dmesg command
  • Hardware detection
  • Driver initialization
  • Boot diagnostics
  • Kernel error analysis
  • Real-time kernel monitoring
  • Production troubleshooting best practices

dmesg is one of the most valuable Linux troubleshooting tools for analyzing kernel activity. It provides visibility into hardware detection, driver initialization, storage devices, networking, and boot events, enabling administrators to diagnose low-level system problems quickly and efficiently.

Key Takeaways

  • dmesg displays messages from the Linux kernel ring buffer.
  • Use dmesg -T for readable timestamps.
  • Monitor live kernel events with dmesg -w.
  • Filter output using grep or --level for faster analysis.
  • Use dmesg when troubleshooting hardware, drivers, storage, and boot issues.
  • Combine dmesg with journalctl and syslog for comprehensive production diagnostics.

What's Next?

logrotate — Managing and Rotating Log Files

You'll explore:

  • Why log rotation is important
  • How logrotate works
  • Log rotation policies
  • Compression and retention
  • Custom log rotation rules
  • Automatic scheduling
  • Production log management best practices

By the end of the lesson, you'll be able to configure and manage log rotation to control disk usage, preserve historical logs, and maintain healthy Linux systems in production.