How to read dmesg from previous session? (dmesg.0)

dmesg

dmesg is a command to read the contents from /var/log/dmesg.
The nice thing compared to less /var/log/dmesg is that I can use the -T flag for human readable time output.

Now I would like to look at /var/log/dmesg.0, to see how my computer crashed. The file contains the logs from previous session. But I want to use the -T flag from the dmesg command. Or something equivalent.

Any idea how?

I would not mind a graphical tool, but the best would be a cli solution.

Best Answer

To clear up a fundamental misconception, dmesg does not read from /var/log/dmesg. It reads directly from the kernel ring buffer and gives you the most recent N messages. Towards the end of the boot process, dmesg is invoked to write the boot messages to /var/log/dmesg (with older versions of that file being rotated in the usual manner).

Once you have a syslog running (syslogd, rsyslogd, syslog-ng, etc.) it reads from the kernel buffer and writes to a file such as /var/log/kern.log. (This is for Debian; other systems will vary). Assuming your system was able to write to disk and flush the disk buffers before it crashed, that is where you will find the dying screams of the kernel.

On my Debian system the /var/log/kern.log file contains human-readable timestamps.

Related Question