203

I'm writing a device driver that prints error message into ring buffer dmesg output. I want to see the output of dmesg as it changes.

How can I do this?

1

7 Answers 7

257

Relatively recent dmesg versions provide a follow option (-w, --follow) which works analogously to tail -f.

Thus, just use following command:

$ dmesg -wH

(-H, --human enables user-friendly features like colors, relative time)

Those options are available for example in Fedora 19.

6
  • 2
    Nice find! Gentoo doesn't grok -H but otherwise spot-on
    – mike3996
    Oct 13, 2013 at 16:19
  • The user space tools need to be version 2.22+. Ubuntu users have to wait for version 14.10 "utopic" Aug 25, 2014 at 7:41
  • 1
    Ubuntu doesn't grok -w - need to use watch (below) Feb 24, 2016 at 0:19
  • 5
    Wow a sysadmin answer that uses --descriptively-named-flags instead of cryptic single-character flags. BRAVO, SIR. BRAVO. Apr 2, 2016 at 4:59
  • 2
    -w should work in every version of Ubuntu from Utopic (14.10) onwards. (launchpad.net/ubuntu/+source/util-linux/+publishinghistory suggests early Utopic packages were for 2.20, but reached 2.25 by the time it was released.)
    – mwfearnley
    Aug 20, 2017 at 13:58
64

You can use the watch command which is intended exactly for things like this

watch -n 0.1 "dmesg | tail -n $((LINES-6))"

the $((LINES-6)) part should make it fit nicely into your terminal.

5
  • 6
    If you use single quotes instead of double quotes (or escape the dollar sign), you'll to get a fresh value of $LINES for every invocation, so it will adjust if you change your terminal size.
    – P Daddy
    Mar 31, 2016 at 15:22
  • Single quotes will inhibit variable expansion. Moreover, the variable is expanded only once in this example - upon invocation of watch. Thus it won't really change between invocations of dmesg. One would need to use a wrapper that would query the terminal state.
    – peterph
    Apr 2, 2016 at 14:29
  • 3
    That's the whole point. The single quotes prohibit the variable expansion when the shell passes the arguments to watch, therefore watch will execute the command with the variable expression in there, which will be expanded by the shell it invokes. Each time. Try it, it works.
    – P Daddy
    Apr 2, 2016 at 14:37
  • Hmm, you are right - I assume watch uses popen(), which means another shell is spawned and the environment variable is then supplied by it (and thus updated on every execute run). Nice find.
    – peterph
    Apr 2, 2016 at 15:14
  • The only option for macOS at this point as it the provided dmseg does not implement the -w flag.
    – ijoseph
    Sep 27, 2020 at 20:59
14

You can't really monitor the output of dmesg directly.

However, chances are high that your module is not printing directly into the ring-buffer of dmesg, but instead uses the kernel logging facilities (which will then be displayed by dmesg). If your syslog has some sane (e.g. default) settings, these messages will most likely also show up in the kern.log logfile.

So you can do something like:

 tail -f /var/log/kern.log
2
  • /var/log/kern.log is fairly Linux-specific. For OpenBSD (and possibly others) the dmesg stuff gets logged in /var/log/messages. Granted, some other stuff goes there too though.
    – kurtm
    Oct 13, 2013 at 14:27
  • 2
    tail -f /var/log/{messages,kernel,dmesg,syslog} via superuser: is-it-possible-to-tail-f-the-output-of-dmesg
    – here
    May 2, 2014 at 7:55
12

You use dmesg to get log messages of the kernel.

The kernel itself logs into a ring buffer, i.e. just in memory. Now all dmesg does is output the content of that ring buffer. If you do dmesg -c it will also delete the ring buffer afterwards.

Therefore you could do something like while true; do dmesg -c; sleep 1; done to have something like the equivalent of a not working dmesg|tail. But this deletes the ring buffer and therefore needs root powers.

The other way is the file /proc/kmsg which allows a view on the ring buffer. You could do tail -f /proc/kmsg, but this is only allow to one process, and this is usually your logging daemon. - It's job is to read the messages and write it to real files (usually in /var/log) where they can be read. It can be configured to output all messages to a single file or different parts into different files. (But configuration depends on the logging daemon of your system.)

Therefore have a look at /var/log if there is any file which suits your needs and configure your logging daemon otherwise.

2
  • // , On the CEntOS 6 system I'm using, tailing and viewing /proc/kmsg produces no output. [~]$ sudo tail -f /proc/kmsg ♥% [~]$ sudo cat /proc/kmsg ♥% [~]$ Sep 4, 2015 at 19:36
  • /dev/kmsg is better. unix.stackexchange.com/a/294206/5132
    – JdeBP
    Jan 8, 2020 at 16:22
9

If you are using an embedded system, like BusyBox that is common on systems like OpenWrt, it has very limited functionality and only 2-3 flags are supported.

If you want a quick and dirty way of printing dmesg output on the screen continually as events change, a simple Bash loop works fine. It's not ideal, but as I mentioned the BusyBox dmesg is missing a lot of functions. I find the following has the same effect when entered in to the command line:

$ while true; do dmesg -c ; sleep 1 ; done

You can quit the loop with Ctrl + C. The sleep 1 is to stop it battering the CPU needlessly, and the -c flag clears the buffer on each call so you don't see repeated output every second.

1
5

On systems that use systemd you can also:

# journalctl -kf
1
  • 2
    Ubuntu 14.10: ➜ ~ journalctl -kf No journal files were found. May 6, 2015 at 11:46
1

Use these two commands from separate terminals:

  1. while true; do dmesg -c >> test.txt;sleep 1; done
  2. tail -f test.txt

It will achieve a similar result.

2
  • // , This basically instructs dmesg to append output to test.txt, right? And the second command just watches that test.txt file? Sep 4, 2015 at 19:31
  • Thanks .. yes.. the 2nd command watches the changes to dmesg. cat /proc/kmsg can achieve the similar output but it doesn't save the logs to a file.
    – K_K
    Sep 7, 2015 at 6:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.