Converting dmesg Timestamps to Conventional Date and Time Format

1. Overview

The dmesg command is useful for displaying kernel messages. However, it displays the timestamps of the messages relative to the start of the kernel.

In this tutorial, we’ll discuss how to display the dmesg timestamps in a human-readable format.

2. The dmesg Command

dmesg is a command used for examining and controlling the kernel ring buffer. The kernel provides /dev/kmsg as an interface that presents the contents of the kernel ring buffer for user space applications. dmesg uses the stream device /dev/kmsg to display the contents of the kernel ring buffer.

If we use dmesg without any options, it prints all the messages in /dev/kmsg and exits. Let’s list the last five messages in /dev/kmsg:

$ dmesg | tail -5
[   10.533567] 18:34:04.586740 main    6.1.30 r148432 started. Verbose level = 0
[   10.534240] 18:34:04.587382 main    vbglR3GuestCtrlDetectPeekGetCancelSupport: Supported (#1)
[   12.689387] rfkill: input handler disabled
[   17.371674] rfkill: input handler enabled
[   19.303922] rfkill: input handler disabled

We filter the output of dmesg by piping its output with the tail -5 command. The timestamps at the beginning of each message within brackets show the time in seconds since the kernel started. For example, the timestamp [   19.303922] in the last message means that the input handler for rfkill was disabled about 19.3 seconds after the system started.

3. The -T Option of dmesg

Instead of timestamps relative to the start of the kernel, we may want to have conventional timestamps while examining the messages in /dev/kmsg. We use the -T option of dmesg for this purpose:

$ dmesg -T | tail -5
[Mon Mar 20 14:34:05 2023] 18:34:04.586740 main    6.1.30 r148432 started. Verbose level = 0
[Mon Mar 20 14:34:05 2023] 18:34:04.587382 main    vbglR3GuestCtrlDetectPeekGetCancelSupport: Supported (#1)
[Mon Mar 20 14:34:07 2023] rfkill: input handler disabled
[Mon Mar 20 14:34:12 2023] rfkill: input handler enabled
[Mon Mar 20 14:34:14 2023] rfkill: input handler disabled

As it’s apparent from the output, dmesg prints the timestamp of each message using absolute date and time, which is more human-readable. We can also use the –ctime option instead of the -T option. They’re the same.

4. The –time-format Option of dmesg

Another alternative for displaying the kernel messages with human-readable timestamps is the –time-format option of dmesg. This option specifies the timestamp format. We can use the iso format for obtaining a human-readable timestamp:

$ dmesg --time-format iso | tail -5
2023-03-20T14:34:05,533567+03:00 18:34:04.586740 main    6.1.30 r148432 started. Verbose level = 0
2023-03-20T14:34:05,534230+03:00 18:34:04.587382 main    vbglR3GuestCtrlDetectPeekGetCancelSupport: Supported (#1)
2023-03-20T14:34:07,689387+03:00 rfkill: input handler disabled
2023-03-20T14:34:12,371674+03:00 rfkill: input handler enabled
2023-03-20T14:34:14,303922+03:00 rfkill: input handler disabled

The iso timestamp format is YYYY-MM-DD<T>HH:MM:SS,<microseconds><-+><timezone offset from UTC>.

The ctime format, on the other hand, is another format for getting a human-readable timestamp:

$ dmesg --time-format ctime | tail -5
[Mon Mar 20 14:34:05 2023] 18:34:04.586740 main    6.1.30 r148432 started. Verbose level = 0
[Mon Mar 20 14:34:05 2023] 18:34:04.587382 main    vbglR3GuestCtrlDetectPeekGetCancelSupport: Supported (#1)
[Mon Mar 20 14:34:07 2023] rfkill: input handler disabled
[Mon Mar 20 14:34:12 2023] rfkill: input handler enabled
[Mon Mar 20 14:34:14 2023] rfkill: input handler disabled

As it’s apparent from the output, the ctime timestamp format produces the same timestamps as the -T option.

5. Conclusion

In this article, we discussed how to display the timestamps of the kernel messages in a more human-readable format.

Firstly, we learned that dmesg prints the timestamps relative to the beginning of the kernel when we use it with no options.

Secondly, we saw that the -T option is useful for producing human-readable timestamps with absolute date and time.

Finally, we learned that the iso and ctime timestamp formats of the –time-format option are other alternatives for obtaining human-readable timestamps. The ctime timestamp format produces the same timestamp as the -T option.