shield_lock
金大哥
← 返回 Skill 列表
extension
分类: 开发与工程无需 API Key

dmesg

dmesg 读取内核环形缓冲区并打印内核消息，包括硬件错误、驱动程序事件、OOM（内存不足）终止以及启动消息。它是检查硬件故障、内核崩溃和设备级问题的首选位置。触发条件包括：dmesg、内核消息、硬件错误、内核日志、OOM终结者、驱动器错误、USB设备、驱动程序错误、启动消息、内核环形缓冲区、内存不足、网卡错误、磁盘错误、内核中的段错误。

person作者: jakexiaohubgithub
open_in_new仓库download下载资源包

Identity

| Property | Value | |----------|-------| | Binary | dmesg | | Config | No persistent config — invoked directly | | Logs | Kernel ring buffer (volatile, lost on reboot); persistent history in /var/log/kern.log or via journalctl -k | | Type | CLI tool (part of util-linux) | | Install | apt install util-linux / dnf install util-linux (installed by default on all distributions) |

Key Operations

| Task | Command | |------|---------| | Show all kernel messages | dmesg | | Human-readable timestamps (wall clock) | dmesg -T | | Follow new messages as they arrive | dmesg -W | | Filter to errors and warnings only | dmesg --level err,warn | | Filter to kernel facility only | dmesg --facility kern | | Color output by severity | dmesg -L | | Show last 50 lines | dmesg \| tail -50 | | Search for a pattern | dmesg \| grep -i 'oom\|killed' | | Show messages since a relative time | dmesg --since "1 hour ago" | | Show messages since an absolute time | dmesg --since "2024-01-15 10:00:00" | | JSON output (machine-parseable) | dmesg -J | | Clear the ring buffer | dmesg -C | | Human timestamps + follow + color + errors | dmesg -TLW --level err,warn |

Common Failures

| Symptom | Cause | Fix | |---------|-------|-----| | dmesg: read kernel buffer failed: Operation not permitted | kernel.dmesg_restrict is set to 1 | Run with sudo, or sysctl kernel.dmesg_restrict=0 temporarily | | Timestamps show seconds since boot (e.g. [12345.678]) | -T not used; default format is relative to boot | Use dmesg -T to convert to wall-clock times | | Early boot messages are gone | Ring buffer overwritten by later messages on verbose or busy systems | Check /var/log/kern.log or journalctl -k -b for persistent logs | | dmesg -W not available | util-linux version below 2.21 | Upgrade util-linux or use watch -n 1 dmesg \| tail -20 as a fallback | | dmesg --since not recognized | util-linux version below 2.33 | Upgrade, or pipe through grep with a timestamp pattern | | OOM message shows a PID that is already gone | The killed process exited; the PID may have been reused | Correlate with system logs for the process name shown in the OOM line | | dmesg -J fails | util-linux below 2.36 | Upgrade, or parse plain text output |

Pain Points

  • Ring buffer is finite and volatile: the kernel ring buffer holds a fixed amount of data (typically 512 KB to 16 MB depending on kernel config). On verbose or high-traffic systems, old messages are overwritten continuously. For persistent history across reboots and across time, use journalctl -k (systemd journals persist to disk) or /var/log/kern.log.
  • Default timestamps are meaningless without context: [12345.678] means "12345 seconds after boot". This is useless without knowing when the system booted (uptime, who -b). Always use dmesg -T for human-readable wall-clock timestamps. Some older distros default to relative; make -T a habit.
  • OOM kill messages name the victim, not the cause: when the OOM killer fires, it logs the killed PID and process name. The killed process is often not the one that caused the memory pressure — it is the one that was deemed most expendable by the kernel's scoring algorithm. Look at the full OOM log block for the memory map and zone info to identify the actual memory consumer.
  • dmesg -W requires util-linux 2.21+: the --follow / -W flag was added in util-linux 2.21. On older systems (CentOS 7, Ubuntu 16.04), use watch dmesg | tail -20 as a substitute.
  • kernel.dmesg_restrict limits access: hardened distros (Ubuntu 20.04+, RHEL 8+) set kernel.dmesg_restrict=1 by default, blocking dmesg output for non-root users. This is a security feature. For debugging, either use sudo, temporarily set it to 0, or add the user to the adm group (Ubuntu grants dmesg access to adm members).
  • Facility filtering narrows signal-to-noise: the kernel sends messages from many facilities (kern, daemon, user, auth). For hardware diagnostics, --facility kern isolates kernel-originated messages. For USB events, grep -i usb; for drive errors, grep -i 'sd\|nvme\|ata'.

References

See references/ for:

  • cheatsheet.md — 10 task-organized patterns for common dmesg workflows
  • docs.md — man pages and upstream documentation links