Dmesg

✎ This article/section is a stub — some half-sorted notes, not necessarily checked, not necessarily correct. Feel free to ignore, or tell me about it.

dmesg is a fixed-size ringbuffer in linux kernel memory, on the order of hundreds of KByte large.

Ringbuffer means that once full, it rewrites old lines, though whenever this low-level log doesn't have much to say you will still see everything since boot.

...unless and until something starts spamming. In practice, filesystem code can be verbose, and actual problems potentially more so.

...which is why userspace logging programs will often also watch this ringbuffer and put it into a file log that will be everything.

Both

• writing to dmesg (printk()) and
• reading from dmesg (/dev/kmsg)

...is effectively privileged thing, so it is not used for general purpose logging.

Primarily some lower level details from the kernel; things that write to it include

• boot code
• ongoing important events like:
  • device or driver errors
  • changes in connected devices
  • oom-killer
  • segfaults

Note that while it is privileged to read out, your userspace logger might well choose to read out dmesg and write it to its own logs.

(something like /var/log/dmesg, or in in the case of systemd, see e.g. journalctl -t kernel)

That fixed size is usually on the order of dozens to hundreds of kilobytes. If

grep CONFIG_LOG_BUF_SHIFT /boot/config-`uname -r`

says something like

CONFIG_LOG_BUF_SHIFT=18

that means 256KiB (1<<18)

See also:

• https://www.kernel.org/doc/Documentation/ABI/testing/dev-kmsg