CmdID / Programs / Linux and Unix
dmesg
Write the kernel messages to stdout. tldr-pages
GTFOBins file-read, inherit 2 documented commands
How dmesg is abused
file-read
-rFinherit
-HEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for dmesg.
2 documented commands
file-read unprivileged, with sudo, as SUID
dmesg -rF /path/to/input-fileinherit unprivileged, with sudo, as SUID
dmesg -HNone of the 2 commands CmdID reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for dmesg. CmdID reads the line of each that runs dmesg.
Everyday use
Show kernel messages
sudo dmesgIdentifyShow kernel messages in human-readable format (equivalent of dmesg --color --reltime piped to a pager)
sudo dmesg --humanIdentifyShow kernel error messages
sudo dmesg --level errIdentifyNone of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of dmesg
-CClear ring buffer without printing-cClear ring buffer after printing-n LEVELSet kernel logging LEVEL (1-8)-rRaw output (with <level markers>)-SUse syslog(2) rather than /dev/kmsg-s SIZEShow the last SIZE many bytes-THuman readable timestamps-tDon't print timestamps-wKeep waiting for more output (aka --follow)-WWait for output, only printing new messages