How to Use the dmesg Command in Linux to View Kernel Logs

When a Linux server experiences a hardware failure, drops a Wi-Fi connection, or refuses to recognize a newly plugged-in USB drive, standard application logs (like those found in /var/log) often won’t help you. You need to know what the core of the operating system—the kernel—is thinking.

The Linux kernel constantly generates low-level diagnostic messages and stores them in a highly protected area of memory called the ring buffer. To read this buffer and diagnose hardware issues, you must use the dmesg (diagnostic message) command.

In this guide, you will learn how to use dmesg to inspect kernel logs and troubleshoot hardware failures.

The Basic dmesg Command

If you open a terminal and simply type dmesg, the command will dump the entire contents of the kernel ring buffer directly onto your screen. Because this buffer captures every single hardware event since the moment the server booted up, the output will usually be thousands of lines long and scroll past instantly.

To make the output readable, you should always pipe it into the less command, allowing you to scroll through it page by page:

dmesg | less

Note: On many modern Linux distributions (like Ubuntu 20.04 and newer), access to the kernel ring buffer is restricted for security reasons. You will likely need to run the command with root privileges: sudo dmesg.

Making Sense of the Output

When you read the dmesg output, you will notice a number in brackets at the start of every line, like this:

[   12.456789] eth0: link up, 1000Mbps, full-duplex

This is a timestamp, but it is not a normal clock time. It represents the number of seconds that have passed since the system booted. While useful for the kernel, it is terrible for human reading.

To force dmesg to convert those numbers into actual, human-readable dates and times, use the -T (Time) flag:

sudo dmesg -T | less

The output will now look much cleaner: [Mon Oct 31 10:45:12 2024] eth0: link up...

Use Case 1: Troubleshooting USB Drives

If you plug a USB flash drive into your Linux server and it doesn’t automatically mount, you need to know what name the kernel assigned to the drive (e.g., sdb, sdc) so you can mount it manually.

The best way to do this is to plug the drive in, and immediately run dmesg, filtering the output to only show the very end of the log (the most recent events) using the tail command:

sudo dmesg | tail -n 20

You will see a block of text confirming a “New USB device found,” followed by the critical information assigning it a block device name like [sdb] Attached SCSI removable disk.

Use Case 2: Filtering for Errors

If a server is crashing randomly, you don’t want to read thousands of lines of normal boot procedures; you only want to see the errors.

dmesg allows you to filter the output by log level using the -l (level) flag. To only show critical emergencies and errors, run:

sudo dmesg -l emerg,err

Alternatively, you can combine dmesg with grep to search for specific hardware terms. If your Wi-Fi card is dropping connections, search for your wireless interface (e.g., wlan0):

sudo dmesg | grep -i wlan0

By mastering the dmesg command, you gain direct visibility into the hardware layer of your Linux system, allowing you to quickly diagnose driver failures, disk errors, and connectivity drops.