What's the difference of dmesg output and /var/log/messages?

Question

AFAIK dmesg shows information about kernel and kernel modules, and /var/log/messages also shows information produced by kernel and modules.

So what's the difference? Does /var/log/messages ⊂ output of dmesg?

More Info that may be helpful:
- There is a kernel ring buffer, which I think is the very and only place to store kernel log data.
- Article "Kernel logging: APIs and implementation" on IBM DeveloperWorks described APIs and the bird-view picture.

score 66 · Accepted Answer · answered Apr 06 '12 at 04:20

66

dmesg prints the contents of the ring buffer. This information is also sent in real time to syslogd or klogd, when they are running, and ends up in /var/log/messages; when dmesg is most useful is in capturing boot-time messages from before syslogd and/or klogd started, so that they will be properly logged.

answered Apr 06 '12 at 04:20

geekosaur

31,429
5
79
58

4

So `/var/log/messages` and `dmesg` will show the same logs (in different format) after `syslogd` and/or `klogd` started? – xanpeng Apr 06 '12 at 04:56
12

After `klogd` is running, `dmesg` will show only the most recent kernel messages (because the ring buffer is a fixed size and so can only hold so much), without timestamps or other information, while `/var/log/messages` will retain logs according to how `logrotate` is configured and include timestamping (which will be slightly inaccurate for initial boot messages because `dmesg` doesn't have them, so the time `klogd` started is used for all messages read from the kernel buffer). – geekosaur Apr 06 '12 at 05:18
6

@xanpeng `dmesg` only contains messages from the kernel, `/var/log/messages` usually contains logs from applications as well. – Gilles 'SO- stop being evil' Apr 06 '12 at 23:34

jlliagre · Answer 2 · 2013-07-16T09:51:55.590

18

That depends on the operating system. For example on Solaris, dmesg is simply a shell script showing the last 200 lines of the /var/adm/messages.* files.

edited Jul 16 '13 at 09:51

answered Apr 06 '12 at 05:20

jlliagre

60,319
10
115
157

1

Is it colorful too? – Hi-Angel Jan 17 '17 at 16:47
@Hi-Angel No post-processing of the log file so no coloring, just `cat ... | tail -200`. – jlliagre Jan 17 '17 at 17:08

score 9 · Answer 3 · edited Dec 11 '15 at 17:19

9

We can say that dmesg is the subset of /var/log/messages and is maintained in ring buffer.
/var/log/messages includes all the system messages including from starting of the system along with the messages in dmesg. In a nutshell logs from dmesg are dumped in /var/log/messages.
/var/log/messages maintain the general system activity logs and dmesg maintains only the kernel logs.

edited Dec 11 '15 at 17:19

sam

22,265
4
22
30

answered Dec 11 '15 at 16:43

Bhagyesh Dudhediya

704
8
19

score 4 · Answer 4 · edited Jul 09 '15 at 03:48

4

dmesg : dmesg is an (display or driver) message. It is used to examine or control the kernel ring buffer.

messages : It contains global system messages, including the messages that are logged during system startup. There are several things that are logged in /var/log/messages including mail, cron, daemon, kern, auth, etc.

edited Jul 09 '15 at 03:48

Nan Xiao

1,387
6
18
33

answered Apr 06 '12 at 05:18

Mughil

1,963
4
18
23

What's the difference of dmesg output and /var/log/messages?

4 Answers4

Linked