1

dmesg is said to examine or control the kernel ring buffer. But it has option --kernel and --userspace.

Does dmesg get kernel messages from the kernel ring buffer?

Does the kernel ring buffer store only messages generated by the kernel, not those by processes?

Where does dmesg get user space messages?

Do user space messages include those messages generated by all the processes, for example, by cron?

1 Answer 1

2

Does dmesg get kernel messages from the kernel ring buffer?

Yes, as described in man dmesg:

dmesg is used to examine or control the kernel ring buffer.

Does the kernel ring buffer store only messages generated by the kernel, not those by processes?

No, processes can add messages to the kernel ring buffer, by writing to /dev/kmsg.

Where does dmesg get user space messages?

From the kernel ring buffer, using either /dev/kmsg or the syslog system call (not to be confused with the syslog system logger and associated services). Messages are distinguished by their “facility”; kernel messages use the kern facility, user messages the user, mail, daemon etc. facilities (see dmesg --help for a list of supported facilities).

Do user space messages include those messages generated by all the processes, for example, by cron?

No, only those explicitly added to the kernel ring buffer.

syslog dæmons can typically read from the kernel ring buffer on Linux, but that’s the only connection. I’m not aware of anything that writes to the buffer apart from the kernel (which doesn’t need a device to do so), and systemd (which will write to the kernel buffer if it can’t write to its journal or to syslog).

18
  • Thanks. Is /dev/kmsg the device file for the kernel ring buffer? Does dmesg get all the messages (both kernel and user space ones) from /dev/kmsg? /dev/kmsg is named as if to be used by the kernel only, so what processes would like to add messages to the kernel ring buffer (by writing to /dev/kmsg)?
    – Ben
    Apr 3, 2021 at 16:34
  • Is the kernel ring buffer and /dev/kmsg such a place which the syslog daemon does not write to and read from? Is the kernel ring buffer and /dev/kmsg unrelated to the syslog daemon?
    – Ben
    Apr 3, 2021 at 16:38
  • Also see my previous question (unix.stackexchange.com/questions/643119/…) and thanks in advance.
    – Ben
    Apr 3, 2021 at 16:39
  • See the updated answer. Apr 3, 2021 at 19:16
  • /dev/kmsg is a character device. Does being a character device mean it doesn't hold data written to it, and any read will only read data written after the read operation is issued, not data written beforehand?
    – Ben
    Apr 3, 2021 at 20:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .