What's the difference of dmesg output and /var/log/messages?

Question

AFAIK dmesg shows information about kernel and kernel modules, and /var/log/messages also shows information produced by kernel and modules.

So what's the difference? Does /var/log/messages ⊂ output of dmesg?

More Info that may be helpful:
- There is a kernel ring buffer, which I think is the very and only place to store kernel log data.
- Article "Kernel logging: APIs and implementation" on IBM DeveloperWorks described APIs and the bird-view picture.

Solution 1

dmesg prints the contents of the ring buffer. This information is also sent in real time to syslogd or klogd, when they are running, and ends up in /var/log/messages; when dmesg is most useful is in capturing boot-time messages from before syslogd and/or klogd started, so that they will be properly logged.

Solution 2

That depends on the operating system. For example on Solaris, dmesg is simply a shell script showing the last 200 lines of the /var/adm/messages.* files.

Solution 3

• We can say that dmesg is the subset of /var/log/messages and is maintained in ring buffer.
• /var/log/messages includes all the system messages including from starting of the system along with the messages in dmesg. In a nutshell logs from dmesg are dumped in /var/log/messages.
• /var/log/messages maintain the general system activity logs and dmesg maintains only the kernel logs.

Solution 4

dmesg : dmesg is an (display or driver) message. It is used to examine or control the kernel ring buffer.

messages : It contains global system messages, including the messages that are logged during system startup. There are several things that are logged in /var/log/messages including mail, cron, daemon, kern, auth, etc.

View more solutions

Comments

[presence]

So /var/log/messages and dmesg will show the same logs (in different format) after syslogd and/or klogd started?

[geekosaur]

After klogd is running, dmesg will show only the most recent kernel messages (because the ring buffer is a fixed size and so can only hold so much), without timestamps or other information, while /var/log/messages will retain logs according to how logrotate is configured and include timestamping (which will be slightly inaccurate for initial boot messages because dmesg doesn't have them, so the time klogd started is used for all messages read from the kernel buffer).

[Gilles 'SO- stop being evil']

@xanpeng dmesg only contains messages from the kernel, /var/log/messages usually contains logs from applications as well.

[Hi-Angel]

Is it colorful too?

[jlliagre]

@Hi-Angel No post-processing of the log file so no coloring, just cat ... | tail -200.