35

I am completely new to Linux.

I know that dmesg and journalctl record commands invoked by my operating-system, but why do 2 recorders exist, what types of messages should I expect to see within each of them, and what are the differences in their life cycles?

2
  • 1
    I'd suggest a peek in the How to Ask guide, esp. the first point.
    – ilkkachu
    Commented May 25, 2017 at 10:08
  • 1
    Sounds like a great question! In contrast with dmesg, journalctl will show not only kernel messages and not only for the current boot
    – darw
    Commented Nov 11, 2023 at 23:09

1 Answer 1

14

Technically journalctl and dmesg are utilities/commands which can serve you log info.

Both journalctl and dmesg can provide logs produced by the kernel. This will usually include the various device probe messages during the boot sequence as well as any further messages outputted by the kernel during the running of the system (e.g. logging if you plug in a USB). Run journalctl --dmesg (or journalctl -k) to get the same output as dmesg.

These kernel logs come from the kernel ring buffer, which is stored within the memory in which the kernel runs (a trick/hack to allow for early kernel logging before filesystems are mounted etc.), but these messages are eventually made available through /dev/kmesg and /proc/kmesg . Both journalctl and dmesg read these and make the information available to the user.

journalctl - this is the command-line utility for the systemd unit 'journald', often called the system journal, or simply the journal. This is a centralised point compiling various system logs, capturing kernel logs (as above), most or all of systemd logs, and many other userspace programs which have opted to use the journal (I have heard that writing logs to the journal is generally encouraged). Execute [sudo] journalctl -F SYSLOG_IDENTIFIER for a full list of which programs have written to it - mine include cron, su, lightdm, sensors,...

I think journalctl compiles all of its logs in /var/log/journal/ .

(Note that sometimes "journal" refers to a journaled filsystem which tracks changes to a filesystem, allowing the possibility of recovery in the case of a system crash. This journal is not generally accessible to users.)

For more information, see:

3
  • 8
    >If "journal" refers to journalctl, then the two are similar, but not the same. journalctl has a --dmesg option that makes it mimic dmesg. Mind adding more detail what are the diffs? Rimski asked what are the differences and directing them to the manpages doesn't answer the question Commented Dec 2, 2021 at 19:46
  • 4
    @EricS I'm not entirely mistaken, you should be able to suggest edits to the answer. It would also give you the opportunity to change it in the way that your personally prefer. It would be appreciated.
    – Kusalananda
    Commented Dec 23, 2021 at 16:14
  • @EricS, reddit.com/r/redhat/comments/n3b278/comment/gwpmpc0/… may be of more use now that reddit.com/r/redhat/comments/n3b278/… has been deleted. Commented Mar 25 at 22:31

Not the answer you're looking for? Browse other questions tagged .