When a Linux server completely fails to recognize a newly plugged-in USB hard drive, or a network interface card violently crashes immediately after a reboot, standard application log files will be completely useless. These are deep, hardware-level failures occurring directly inside the operating system kernel. To view the raw, highly privileged diagnostic messages generated by the kernel itself, you must use the dmesg (Diagnostic Message) command.
How the Kernel Ring Buffer Works
The Linux kernel operates in the background, constantly communicating with your physical hardware (RAM, CPUs, USB ports, hard drives). Every time the kernel initializes a piece of hardware or detects a low-level error, it logs a message into a highly secure, restricted memory space known as the “ring buffer.”
Because the ring buffer is stored in active RAM (not on the hard drive), it is incredibly fast, but it is wiped clean the moment the server is powered off. To extract and read this volatile data, you must run the following command (which often requires sudo privileges on modern security-hardened distributions):
sudo dmesgThe terminal will instantly vomit thousands of lines of highly technical data. The very first lines are from the exact millisecond the server powered on, documenting the kernel detecting your CPU and RAM. The very last lines represent the most recent hardware events.
How to Filter for Specific Hardware Events
Because the raw output of dmesg is so massive, it is virtually impossible to read manually. You must pipe the output into the grep command to isolate exactly what you are looking for.
If you just plugged in a new USB thumb drive and it is not appearing in the system, you can instantly check if the kernel even detected the electrical connection by filtering for the word “usb”:
sudo dmesg | grep -i usbIf the USB drive is physically broken, you will see bright red error messages indicating a “device descriptor read/all, error -71”.
Similarly, if a hard drive is failing, you can filter for standard storage device names (like sda or nvme):
sudo dmesg | grep -i sdaThis allows you to instantly bypass high-level software issues and determine with absolute certainty if your physical hardware components are actively failing or functioning correctly at the deepest level of the operating system.