Dmesg

✎ This article/section is a stub — some half-sorted notes, not necessarily checked, not necessarily correct. Feel free to ignore, or tell me about it.

dmesg is a fixed-size ringbuffer within linux kernel memory, on the order of hundreds of KByte large.

It is used primarily for some lower level details from the kernel. System code that writes logs to it includes

• boot code
• ongoing important events like:
  • device or driver errors
  • changes in connected devices
  • oom-killer
  • segfaults

Both

• writing to dmesg (printk()) and
• reading from dmesg (/dev/kmsg)

...is effectively privileged thing, so it is not used for general purpose logging.

reading' it can be done via /dev/kmsg, a character device that provides userspace access to that buffer (still requires root privileges), which seems to be most of what the dmesg command does.

As may your userspace logger, because that way it is much more likely that you do put everything since boot in some place you can read off. ...which will often be in a place like /var/log/dmesg, or in in the case of systemd, see e.g. journalctl -t kernel

Notes:

• If you want to know the size exactly, grep CONFIG_LOG_BUF_SHIFT /boot/config-`uname -r` should tell you - something like CONFIG_LOG_BUF_SHIFT=18 means that means 256KiB (1<<18)).

• "Ringbuffer" means that, once full, it overwrites the oldest lines

System loggers might track of that, so that their own copy is complete, or at least much longer, even if more than its size worth of logging is done.

Even if they don't, there often isn't enough messaging to fill all of it very quickly, unless something really spams a lot.

See also:

• https://www.kernel.org/doc/Documentation/ABI/testing/dev-kmsg