In a CentOS 7 server, I typed dmesg and noted the time stamp of the last entry.

Next, I typed tail -f /var/log/dmesg in a DIFFERENT TERMINAL ON THE SAME MACHINE, so that I could watch the log tail.

Third, I ran some scripts on the same machine using the same terminal. Nothing changed in the terminal in which I had typed tail -f /var/log/dmesg.

Finally, I typed dmesg again, extracted the log into Notepad++, and noticed that over 1,500 lines of new logs had been created in the dmesg output while I was running the other scripts.

What specific commands must be typed in order to get the tail of the dmesg logs to actually display on the screen?

  • I was mistaken; I had forgotten that dmesg is a ring buffer. CentOS 7 might have dmesg -w or dmesg --follow. – DopeGhoti Mar 29 '17 at 18:20

dmesg is a ring buffer. Which is to say, when it reaches a certain size, old data are thrown out. Because of this, it doesn't really work like a normal file. It's kind of like the data in /proc - when you cat or otherwise display it, you see only the state at that instant.

To get around this, newer implementations of dmesg include the -w or --follow switches, which work effectively like tail -f. If you want to capture this into a conventional file rather than a ring buffer, you can use a construct such as:

dmesg --follow >> /path/to/file

Or, if you wish to also see what is being captured:

dmesg --follow | tee -a /path/to/file

As with tail -f, this can be terminated with a simple INT signal or Ctrl-C.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.