如何查看系统日志

1、dmesg简介

‘dmesg’命令设备故障的诊断是非常重要的。在‘dmesg’命令的帮助下进行硬件的连接或断开连接操作时，我们可以看到硬件的检测或者断开连接的信息。‘dmesg’命令在多数基于Linux和Unix的操作系统中都可以使用。在引导过程中以及系统运行时，内核会将各种消息写入内核环形缓冲区。这些消息包括有关系统操作的各种信息。内核环形缓冲区是物理内存的一部分，用于保存内核的日志消息。它具有固定的大小，这意味着一旦缓冲区已满，较旧的日志记录将被覆盖。dmesg 命令行实用程序用于在 Linux 和其他类似 Unix 的操作系统中打印和控制内核环形缓冲区。对于检查内核启动消息和调试与硬件相关的问题很有用。

2、demsg日志

内核参数 kernel.dmesg_restrict 指定非特权用户是否可以使用 dmesg 查看来自内核日志缓冲区的消息。要删除限制，请将其设置为零：

[[email protected]_0_11_centos ~]# sysctl -a | grep dmesg
kernel.dmesg_restrict = 0

dmesg 从 /proc/kmsg 虚拟文件中读取内核生成的消息。该文件提供了到内核环形缓冲区的接口，并且只能由一个进程打开。如果系统上正在运行 syslog 进程，并且你尝试使用cat 或 less 命令读取文件，则命令将挂起。syslog 守护程序将内核消息转储到 /var/log/dmesg，因此你也可以使用该日志文件：

[[email protected]_0_11_centos ~]# systemctl -a | grep dmesg
  rhel-dmesg.service                                                                  loaded    active   exited    Dump dmesg to /var/log/dmesg

3、命令使用

1）格式化输出

-H 更容易阅读的方式
[[email protected]_0_11_centos ~]# dmesg -H 
[Dec13 23:54] Initializing cgroup subsys cpuset
[  +0.000000] Initializing cgroup subsys cpu
[  +0.000000] Initializing cgroup subsys cpuacct
[  +0.000000] Linux version 3.10.0-957.21.3.el7.x86_64 ([email protected]) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC) ) #1
[  +0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-3.10.0-957.21.3.el7.x86_64 root=UUID=4b499d76-769a-40a0-93dc-4a31a59add28 ro crashkernel=128M co
[  +0.000000] e820: BIOS-provided physical RAM map:

带有时间戳的格式化输出
[[email protected]_0_11_centos ~]# dmesg -T
[Fri Dec 13 23:54:22 2019] Initializing cgroup subsys cpuset
[Fri Dec 13 23:54:22 2019] Initializing cgroup subsys cpu
[Fri Dec 13 23:54:22 2019] Initializing cgroup subsys cpuacct
[Fri Dec 13 23:54:22 2019] Linux version 3.10.0-957.21.3.el7.x86_64 ([email protected]) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC) ) #1 SMP Tue Jun 18 16:35:19 UTC 2019
[Fri Dec 13 23:54:22 2019] Command line: BOOT_IMAGE=/boot/vmlinuz-3.10.0-957.21.3.el7.x86_64 root=UUID=4b499d76-769a-40a0-93dc-4a31a59add28 ro crashkernel=128M console=ttyS0 console=tty0 panic=5 net.ifnames=0 biosdevname=0
[Fri Dec 13 23:54:22 2019] e820: BIOS-provided physical RAM map:
[Fri Dec 13 23:54:22 2019] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[Fri Dec 13 23:54:22 2019] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
[Fri Dec 13 23:54:22 2019] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
[Fri Dec 13 23:54:22 2019] BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff] usable
[Fri Dec 13 23:54:22 2019] BIOS-e820: [mem 0x000000007ffdc000-0x000000007fffffff] reserved
[Fri Dec 13 23:54:22 2019] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved

2）过滤相关信息

[[email protected]_0_11_centos ~]# dmesg -T | grep -i usb
[Fri Dec 13 23:54:23 2019] ACPI: bus type USB registered
[Fri Dec 13 23:54:23 2019] usbcore: registered new interface driver usbfs
[Fri Dec 13 23:54:23 2019] usbcore: registered new interface driver hub
[Fri Dec 13 23:54:23 2019] usbcore: registered new device driver usb
[Fri Dec 13 23:54:23 2019] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[Fri Dec 13 23:54:23 2019] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[Fri Dec 13 23:54:23 2019] uhci_hcd: USB Universal Host Controller Interface driver
[Fri Dec 13 23:54:23 2019] uhci_hcd 0000:00:01.2: new USB bus registered, assigned bus number 1
[Fri Dec 13 23:54:23 2019] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001
[Fri Dec 13 23:54:23 2019] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1

3）实时输出

方法一：
[[email protected]_0_11_centos ~]# dmesg -w
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.0-957.21.3.el7.x86_64 ([email protected]) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC) ) #1 SMP Tue Jun 18 16:35:19 UTC 2019
方法二：

[[email protected]_0_11_centos ~]# tail -f /var/log/dmesg
[    2.996605] piix4_smbus 0000:00:01.3: SMBus Host Controller at 0x700, revision 0
[    3.023032] input: PC Speaker as /devices/platform/pcspkr/input/input4
[    3.050660] sr 0:0:1:0: Attached scsi generic sg0 type 5
[    3.060690] cryptd: max_cpu_qlen set to 1000
[    3.128300] AVX2 version of gcm_enc/dec engaged.

4）清空环形缓冲区

[[email protected]_0_11_centos ~]# dmesg -C
[[email protected]_0_11_centos ~]# dmesg