If you have experience with digging system log, you may be familiar with the
dmesg command or the content of
However, the content of
/var/log/dmesg is usually not up to date as what is printed by
dmesg command. This post will make everything clear.
What does the dmesg command do?
Linux kernel has its own log buffer initialized when the system boots. This log buffer is flushed continuously by the kernel. When being invoked the
dmesg prints last N lines of the buffer.
What does /var/log/dmesg store?
After the system booted, the kernel buffer is written to
/var/log/dmesg (by the
dmesg command with a particular flag). Afterward, the system log is not flush with this file anymore. This explains why
var/log/dmesg only contains a part of the kernel log.
How to get a full kernel log?
syslog service is a service that keeps flushing kernel log buffer content to
# systemctl list-unit-files | grep syslog rsyslog.service enabled syslog.service enabled syslog.socket static
kern.log is rotated in a common manner. i.e. the previous log can be found from
How to get kernel log in pretty printed format?
journalctl is a handy tool for this purpose, it can be invoked with the following flags
- k (dmesg): kernel log only
- -b <boot_number>: boot order (0, -1, -2, ...)