What's the difference of dmesg output and /var/log/messages?

Question

AFAIK dmesg shows information about kernel and kernel modules, and /var/log/messages also shows information produced by kernel and modules.

So what's the difference? Does /var/log/messages ⊂ output of dmesg?

More Info that may be helpful:
- There is a kernel ring buffer, which I think is the very and only place to store kernel log data.
- Article "Kernel logging: APIs and implementation" on IBM DeveloperWorks described APIs and the bird-view picture.

score 68 · Accepted Answer · answered Apr 06 '12 at 04:20

68

dmesg prints the contents of the ring buffer. This information is also sent in real time to syslogd or klogd, when they are running, and ends up in /var/log/messages; when dmesg is most useful is in capturing boot-time messages from before syslogd and/or klogd started, so that they will be properly logged.

answered Apr 06 '12 at 04:20

geekosaur

32,047

4

So /var/log/messages and dmesg will show the same logs (in different format) after syslogd and/or klogd started? – xanpeng Apr 06 '12 at 04:56
13

After klogd is running, dmesg will show only the most recent kernel messages (because the ring buffer is a fixed size and so can only hold so much), without timestamps or other information, while /var/log/messages will retain logs according to how logrotate is configured and include timestamping (which will be slightly inaccurate for initial boot messages because dmesg doesn't have them, so the time klogd started is used for all messages read from the kernel buffer). – geekosaur Apr 06 '12 at 05:18
6

@xanpeng dmesg only contains messages from the kernel, /var/log/messages usually contains logs from applications as well. – Gilles 'SO- stop being evil' Apr 06 '12 at 23:34

jlliagre · Answer 2 · 2013-07-16T09:51:55.590

18

That depends on the operating system. For example on Solaris, dmesg is simply a shell script showing the last 200 lines of the /var/adm/messages.* files.

edited Jul 16 '13 at 09:51

answered Apr 06 '12 at 05:20

jlliagre

61,204

1

Is it colorful too? – Hi-Angel Jan 17 '17 at 16:47
@Hi-Angel No post-processing of the log file so no coloring, just cat ... | tail -200. – jlliagre Jan 17 '17 at 17:08

score 11 · Answer 3 · edited Dec 11 '15 at 17:19

11

We can say that dmesg is the subset of /var/log/messages and is maintained in ring buffer.
/var/log/messages includes all the system messages including from starting of the system along with the messages in dmesg. In a nutshell logs from dmesg are dumped in /var/log/messages.
/var/log/messages maintain the general system activity logs and dmesg maintains only the kernel logs.

edited Dec 11 '15 at 17:19

sam

22,765

answered Dec 11 '15 at 16:43

Bhagyesh Dudhediya

734

score 5 · Answer 4 · edited Jul 09 '15 at 03:48

5

dmesg : dmesg is an (display or driver) message. It is used to examine or control the kernel ring buffer.

messages : It contains global system messages, including the messages that are logged during system startup. There are several things that are logged in /var/log/messages including mail, cron, daemon, kern, auth, etc.

edited Jul 09 '15 at 03:48

Nan Xiao

1,407

answered Apr 06 '12 at 05:18

Mughil

1,973

What's the difference of dmesg output and /var/log/messages?

4 Answers4

Linked