Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUse dmesg to inspect messages in the Linux kernel ring buffer, then narrow them by priority, facility, wording, or timing to investigate a boot, hardware, or device problem. The command can show what the kernel reported, but a warning or error is a clue—not proof of the root cause. For an issue from an earlier boot on a systemd system, try journalctl -k -b -1 if the journal retained those records.
What dmesg can show—and what it cannot
The upstream util-linux manual describes dmesg as a tool to “examine or control the kernel ring buffer.” Its default action displays messages currently available there. Those messages can help you investigate startup, hardware detection, device connections, and kernel-reported errors.
As an Amazon Associate I earn from qualifying purchases.
The ring buffer is not a complete, permanent history of every event on the machine. Its contents may not include messages from an earlier boot, and old entries may no longer be available. Use the messages alongside the symptom you observed and other relevant logs rather than treating one line as a diagnosis.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute12 useful command patterns
Options vary by util-linux version and distribution build. Check your installed command before relying on an option:
#1 Best Overall
dmesg --help1. Display available kernel messages
dmesgStart here for a broad view of the messages currently in the kernel ring buffer. If the output is long, search for a device name, driver, recognizable error text, or the approximate time the problem began.
2. Watch for new messages
dmesg --followWhere readable /dev/kmsg support is available, this waits for new kernel messages. Keep it open while reproducing an issue—for example, while connecting a device—and note which entries appear at that moment.
3. Show errors and warnings
dmesg --level=err,warnThis limits output to the error and warning priorities where supported. It can reduce noise during an initial scan, but less severe messages may still provide useful context.
Recommended Free Tools
Rank #2
4. Limit output to the kernel facility
dmesg --facility=kernWhere supported, this selects messages associated with the kernel facility. It is useful when the output contains multiple facilities and you want to focus on kernel entries.
5. Decode facility and priority names
dmesg --decodeThis asks dmesg to display facility and priority in human-readable form. Use it when the message metadata is less familiar than the message text itself.
6. Use human-readable output and pager behavior
dmesg --humanWhere available, this requests human-readable output and pager behavior. The exact display depends on the installed build and terminal environment; consult dmesg --help for its supported behavior.
Rank #3
7. Show time deltas between messages
dmesg --show-deltaThis displays the time difference between adjacent messages. Deltas can help you see whether a burst of messages followed a device failure or whether activity was spread over a longer period.
Free tools Windows power users keep installed
One-click scans. No signup required.
8. Show local time with deltas
dmesg --reltimeThis requests local-time display and deltas where supported. Treat converted wall-clock timestamps as approximate context, not guaranteed exact event times: the manual documents accuracy caveats for human-readable time conversion.
9. Request ISO-style timestamps
dmesg --time-format=isoWhere supported, this requests ISO-style timestamps. Valid formats can differ by version, so check the local help before using a format in a script or troubleshooting procedure.
10. Clear the kernel ring buffer
dmesg --clearThis changes diagnostic state by clearing the ring buffer. Do not run it casually while preserving evidence matters: messages you could otherwise inspect may be lost from that buffer.
11. Read supported syslog-format messages from a file
dmesg --file FILEReplace FILE with the path to a file containing supported syslog-format messages. The upstream manual notes that this mode does not support kmsg-format messages; check the manual and your installed help for details.
12. Query kernel messages from the previous boot
journalctl -k -b -1This is a journalctl command, not a dmesg option. On a systemd system, it selects kernel messages from the previous boot if the journal collected and retained them. The journalctl manual documents kernel-only and boot-selection options.
How to investigate a kernel or device problem
- Begin with a read-only check. Run
dmesgto see the messages currently available. Avoid clearing the buffer if you may need its contents as evidence. - Narrow the output to the symptom. Try a priority filter such as
--level=err,warn, a facility filter such as--facility=kern, or search the displayed text for the device name or a distinctive phrase. Option support depends on your installed build. - Compare message order and timing. Use deltas where available, and compare nearby entries with the time the symptom began. For a device problem, connect or reproduce the failure while watching with
dmesg --follow, if permitted, and correlate new messages with that action. - Check other logs and the actual symptom. A warning or error does not establish root cause on its own. Look for related evidence and whether the message coincides with the behavior you are troubleshooting.
- For a previous-boot issue, check the journal. On a systemd system, run
journalctl -k -b -1to request kernel messages from the prior boot. Results depend on journal collection and retention; use journal boot selection or filtering to focus the records further.
If dmesg reports permission denied
Access may be restricted by the kernel’s dmesg_restrict setting. The upstream manual notes this as a common cause of access denial. Do not treat disabling the restriction as a routine troubleshooting step. Ask an authorized administrator to assess the system’s security policy and determine whether access is appropriate.
dmesg and journalctl: which should you use?
| Question | dmesg |
journalctl -k -b -1 |
|---|---|---|
| What does it read? | Messages available in the current kernel ring buffer. | Kernel messages collected in the systemd journal for the previous boot. |
| How far back can it go? | Limited to messages still available in the ring buffer. | Can select a prior boot when its records were collected and retained. |
| How can you narrow results? | Supported message priority and facility filters, plus recognizable message text. | Kernel-message selection and boot selection; journal filtering can further narrow records. |
| What does access depend on? | Permission to read the kernel buffer, which may be restricted by dmesg_restrict. |
A systemd journal with the relevant records available and retained. |
These commands address different sources and time ranges. Use dmesg for messages available in the current ring buffer and the journal query when you need retained records from an earlier boot; neither is a universal replacement for the other.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
