Part II · Your system

21.3 dmesg and the kernel log

alsodmesgkernel logkmsgkernel messagesdmesg_restrict

TL;DR

The kernel keeps its messages in a buffer in RAM: hardware found, driver errors, OOM kills, a USB stick plugged in.
dmesg prints that buffer. journalctl -k shows the same messages, kept across reboots when the journal is persistent.
With kernel.dmesg_restrict = 1, the default on many distros, reading it needs root.

sudo dmesg -T | tail -20       # with human-readable times
sudo dmesg -w                  # follow new messages
journalctl -k -b -1 -p err     # errors from the previous boot

On your machine

alice@laptopexample

$ atfq 21.3
  vm.swappiness                    60  how willing the kernel is to swap
  vm.overcommit_memory 0 0 guess, 1 always say yes, 2 strict limit
  kernel.dmesg_restrict             1  1: reading dmesg needs root
  net.ipv4.ip_forward               1  1: this machine routes packets
  kernel.sysrq 176 0 off, 1 all, other: some Alt+SysRq keys
  fs.inotify.max_user_watches  524288  files a user can watch for changes
  Set in    vm.swappiness = 10 (/etc/sysctl.d/90-swap.conf)
            fs.inotify.max_user_watches = 524288
            (/etc/sysctl.d/99-inotify.conf)

An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.

Pitfalls

The buffer has a fixed size: on a busy machine, early boot messages are overwritten. journalctl -k -b still has them.
dmesg -T times can be wrong after a suspend: the kernel's clock doesn't count the time spent suspended.
To see how the kernel names a device, run sudo dmesg -w, then plug it in.
A "Call Trace" block means the kernel hit a bug or a warning: the whole block, not just one line, is what a bug report needs.

Deep dive 2 questions

Why does dmesg need root?

Kernel messages can contain memory addresses, which help an attacker get around protections such as address randomization. So many distros set kernel.dmesg_restrict = 1, and dmesg then needs root. Members of the adm or systemd-journal group can still read the same messages with journalctl -k.

What are log levels?

Each kernel message has a level, from 0 (emergency) to 7 (debug); 3 is an error, 4 a warning. dmesg -l err,warn shows only those, and journalctl -k -p warning does the same from the journal.

Commands: dmesg journalctl
Paths: /dev/kmsg
See also: 21.2 Kernel modules
17.2 The OOM killer