Andrew Mercer
on this page

    The kernel writes messages into a fixed-size circular buffer. Early boot messages, driver errors, OOM-killer events, hardware faults and firewall LOG targets all land here.

    dmesg                       # entire buffer
dmesg -T                    # human-readable timestamps
dmesg -H                    # human-friendly, paged, coloured
dmesg -w                    # follow new messages (like tail -f)
dmesg -l err,crit,alert,emerg   # filter by level
dmesg -f kern               # filter by facility
dmesg --time-format iso     # ISO 8601 timestamps

journalctl -k               # kernel messages for this boot via the journal
journalctl -k -b -1         # kernel messages from the previous boot

    Notes:

    • dmesg -T timestamps are derived from monotonic time and can drift or be wrong after suspend/resume. Use journalctl -k for accurate wall-clock times.
    • kernel.dmesg_restrict = 1 (default on many distros) means only root (or CAP_SYSLOG) can read it.
    • The buffer is small and wraps. If it matters after a reboot, it needs to be in a persistent journal or a syslog file.
    • Console verbosity is controlled by /proc/sys/kernel/printk (sysctl kernel.printk). That changes what is printed to the console, not what is recorded.

    Common things to grep for:

    dmesg -T | grep -iE 'oom|killed process'          # OOM killer
dmesg -T | grep -iE 'i/o error|blk_update|ata[0-9]' # disk problems
dmesg -T | grep -iE 'segfault|general protection'  # crashing processes
dmesg -T | grep -iE 'mce|machine check|edac'       # hardware/memory errors