1

In Fedora 29 (which I'm forced to use), dmesg lacks the options --since and --until like journalctl does.

journalctl --since "2022-12-20 09:00:00" --until "2022-12-20 10:00:00"

How dmesg logs within 9AM to 10AM of Dec 20 can be filtered to be shown?

Improve this question
11
  • 1
    Did you check the man page of dmesg? man7.org/linux/man-pages/man1/dmesg.1.html Commented Dec 21, 2022 at 18:15
  • Yes, it lacks the options since and until in the version I have (2.32.1) Commented Dec 21, 2022 at 21:58
  • @Damon do you have --time-format option in your dmesg version? It should be useful to know if you do it to can run this command and parse it correctly: sudo dmesg --time-format 'ctime' Commented Dec 22, 2022 at 2:18
  • journalctl is also able to show dmesg messages by using sudo journalctl -k (but given that you say that journalctl does not have the options --since and --until then this is not so useful) Commented Dec 22, 2022 at 2:20
  • Actually, my wording was confusing, journalctl has those options under my system. I will check -k tomorrow to see if I get the oom-kill log which is the one I care about. My dmesg also has --time-format as an option. I noticed I can use date -d $(dmesg -T --time-format iso | grep -w "oom-kill" | cut -d ',' -f 1) +%s to get the time of the log (in seconds from epoch) for doing comparison. Commented Dec 22, 2022 at 2:37

2 Answers 2

Reset to default
2

The --time-format long option for dmesg is a possibility using the iso format:

(note the T and no space between the date and the time, due to the iso format)

The sed only works if you have a line with 2022-12-12T09 and a line with 2022-12-12T10 in your logs.

$ sudo dmesg --time-format=iso | sed -n '/2022-12-12T09/,/2022-12-12T10/p'


You could alternatively do something like this to add more specificity to the time range (here, we are grabbing only the specified minutes in the range):

In this one, you'd also need a line with 2022-12-12T09:16 and a line with 2022-12-12T09:24 in your logs.

$ sudo dmesg --time-format=iso | sed -n '/2022-12-12T09:16/,/2022-12-12T09:24/p'

From the manpage

--time-format format Print timestamps using the given format, which can be ctime, reltime, delta or iso. The first three formats are aliases of the time-format-specific options. The iso format is a dmesg implementation of the ISO-8601 timestamp format. The purpose of this format is to make the comparing of timestamps between two systems, and any other parsing, easy. The definition of the iso timestamp is: YYYY-MM-DDHH:MM:SS,<-+>.

The iso format has the same issue as ctime: the time may be inaccurate when a system is suspended and resumed.

Improve this answer
4
  • I'm not sure what you are trying to achieve with sed! How do you filter logs only between 9 AM to 10 AM? For example a log that has timestamp 2022-12-12T09:26:19 should be shown. Consider 9 and 10 are arbitrary. This can be between any two dates with possibly different days and hours. Commented Dec 29, 2022 at 17:34
  • I was able to test it. You are basically printing all lines between the two. Did it work for you? Commented Dec 29, 2022 at 22:08
  • For me, it doesn't show any logs between the specified range, although I know there are logs with timestamp in that range. Commented Dec 30, 2022 at 0:31
  • @Damon, updated answer to clarify Commented Jan 3, 2023 at 23:44
0

I wrote a little script to collect logs from a range

while read line; do d=$(echo $line | cut -d ',' -f 1) if [[ $line =~ ^[[:digit:]] ]] && [[ `date -d "$d" +%s` > `date --date="2 hours ago" +%s` ]] then echo $line fi done < <(dmesg -T --time-format iso)

This will only show logs since 2 hours ago. until can be scripted using the same logic and a different math. The only problem is, it's slower than dmesg itself.

Improve this answer
2
  • Indeed, Bash while read loop extremely slow compared to cat, why? but this could probably be refactored to use Awk, especially if your date stamps are in a sane machine-readable format. Commented Dec 29, 2022 at 19:46
  • 1
    I found out even a worse problem! dmesg -T doesn't report the timestamp accurately! It's 12 minutes behind and it could be days according to this: serverfault.com/questions/576139/… I will try other solution, thank you all for helping me. Commented Dec 30, 2022 at 0:32

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.