Identifier / Programs / Linux and Unix
dmesg
Write the kernel messages to stdout. tldr-pages
GTFOBins file-read, inherit 2 documented commands
How dmesg is abused
file-read
-rFinherit
-HEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for dmesg.
2 documented commands
file-read unprivileged, with sudo, as SUID
dmesg -rF /path/to/input-fileinherit unprivileged, with sudo, as SUID
dmesg -HNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for dmesg. The identifier reads the line of each that runs dmesg.
Everyday use
Show kernel messages
sudo dmesgIdentifyShow kernel messages in human-readable format (equivalent of dmesg --color --reltime piped to a pager)
sudo dmesg --humanIdentifyShow kernel error messages
sudo dmesg --level errIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of dmesg
-CClear ring buffer without printing-cClear ring buffer after printing-n LEVELSet kernel logging LEVEL (1-8)-rRaw output (with <level markers>)-SUse syslog(2) rather than /dev/kmsg-s SIZEShow the last SIZE many bytes-THuman readable timestamps-tDon't print timestamps-wKeep waiting for more output (aka --follow)-WWait for output, only printing new messages