dmesg Command – Why is dmesg Called dmesg?

You need to look at either /etc/rsyslog.conf or /etc/syslog.conf. If you have a line early on such as:

*.*                -/var/log/syslog

Everything, including the stuff from dmesg, should go to that file. To target it better:

kernel.*           -/var/log/dmesg

If that fails for some reason, you could periodically (e.g. via cron):

dmesg > /var/log/dmesg

Depending on how big the dmesg buffer is (this is compiled into the kernel, or set via the log_buf_len parameter) and how long your system has been up, that will keep a record of the kernel log since it started.

If you want to write the dmesg output continuously to a file use the -w (--follow) flag.

dmesg --follow > mydmesg.log

To clear up a fundamental misconception, dmesg does not read from /var/log/dmesg. It reads directly from the kernel ring buffer and gives you the most recent N messages. Towards the end of the boot process, dmesg is invoked to write the boot messages to /var/log/dmesg (with older versions of that file being rotated in the usual manner).

Once you have a syslog running (syslogd, rsyslogd, syslog-ng, etc.) it reads from the kernel buffer and writes to a file such as /var/log/kern.log. (This is for Debian; other systems will vary). Assuming your system was able to write to disk and flush the disk buffers before it crashed, that is where you will find the dying screams of the kernel.

On my Debian system the /var/log/kern.log file contains human-readable timestamps.