# How to collect \`dmesg\` outputs - or those logs are useless?

**URL:** <https://discuss.elastic.co/t/how-to-collect-dmesg-outputs-or-those-logs-are-useless/262714>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 30, 2021, 1:57pm UTC](https://discuss.elastic.co/t/how-to-collect-dmesg-outputs-or-those-logs-are-useless/262714 "2021-01-30T13:57:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fzyzcjy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fzyzcjy/32/78628_2.png) [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\
**Post date:** [January 30, 2021, 1:57pm UTC](https://discuss.elastic.co/t/how-to-collect-dmesg-outputs-or-those-logs-are-useless/262714/1 "2021-01-30T13:57:43Z")

</div>

Hi thanks for the lib! I wonder (1) whether I should collect `dmesg` outputs? Are they useful or useless? In addition, I wonder how can I collect them using Filebeat?

Thanks!

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [February 1, 2021, 12:33pm UTC](https://discuss.elastic.co/t/how-to-collect-dmesg-outputs-or-those-logs-are-useless/262714/2 "2021-02-01T12:33:54Z")

</div>

The output of `dmesg` is usually written to `/var/log/messages`. It contains valuable information about what the kernel is doing. If I were you, I would collect these events, by reading from the aforementioned file by using the system module of Filebeat: [System module | Filebeat Reference [7.10] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html)

---

<div class="post-metadata">

**Author:** ![fzyzcjy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fzyzcjy/32/78628_2.png) [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\
**Post date:** [February 1, 2021, 2:08pm UTC](https://discuss.elastic.co/t/how-to-collect-dmesg-outputs-or-those-logs-are-useless/262714/3 "2021-02-01T14:08:54Z")

</div>

Thanks! Actually I find that `/var/log/messages` contain a _lot_ of other kinds of messages (actually 20 message per second!) besides dmesg messages. For example,

```auto
sudo tail -f /var/log/messages

...
2021-02-01T22:08:21.263105+08:00 test-one-01106 dockerd: time="2021-02-01T22:08:21.262884703+08:00" level=info msg="exit-del moby/4ec68ae8b259afb67051cd12f6a92f1254a4b9d946ce182744848f310146d64d.20084.0 error=<nil>"
2021-02-01T22:08:21.263272+08:00 test-one-01106 dockerd: time="2021-02-01T22:08:21.263004731+08:00" level=info msg=event ExitStatus=0 ExitedAt="2021-02-01 14:08:21.248590102 +0000 UTC" Pid=20084 ProcessID=7c08dc1659d0c6ad33e8506e7deb52b6f105a34fd3d7820661414b25c599e6e3 containerID=4ec68ae8b259afb67051cd12f6a92f1254a4b9d946ce182744848f310146d64d module=libcontainerd namespace=moby topic=/tasks/exit
2021-02-01T22:08:21.278362+08:00 test-one-01106 dockerd: time="2021-02-01T22:08:21.277729129+08:00" level=info msg="exit-del moby/f01fa8dddb61fd851284bb2a84e4e122ae7fb069552e1dd9e2ef092cd028f4c1.20074.0 error=<nil>"
2021-02-01T22:08:21.278634+08:00 test-one-01106 dockerd: time="2021-02-01T22:08:21.277874239+08:00" level=info msg=event ExitStatus=0 ExitedAt="2021-02-01 14:08:21.248181225 +0000 UTC" Pid=20074 ProcessID=654acb5d27fb6c90699e9270a30696e41c264f7e393c5199d5ed7c6b9ab218e5 containerID=f01fa8dddb61fd851284bb2a84e4e122ae7fb069552e1dd9e2ef092cd028f4c1 module=libcontainerd namespace=moby topic=/tasks/exit
2021-02-01T22:08:21.307263+08:00 test-one-01106 sh: [/usr/local/bin/kubelet][INFO] check success
2021-02-01T22:08:21.327383+08:00 test-one-01106 dockerd: time="2021-02-01T22:08:21.327081111+08:00" level=info msg=event Pid=20203 containerID=441f968f24e3a8b4043919164c0d4d377178f379535454971b85baf1a473b4c0 execID=24bb9cb09ac52312a0722215ccc4a3cfb6c51d5b68aa4afbc91f491834657a4a module=libcontainerd namespace=moby topic=/tasks/exec-started
2021-02-01T22:08:21.346006+08:00 test-one-01106 dockerd: time="2021-02-01T22:08:21.343676937+08:00" level=info msg="exit-del moby/441f968f24e3a8b4043919164c0d4d377178f379535454971b85baf1a473b4c0.20203.0 error=<nil>"
2021-02-01T22:08:21.346240+08:00 test-one-01106 dockerd: time="2021-02-01T22:08:21.343865950+08:00" level=info msg=event ExitStatus=0 ExitedAt="2021-02-01 14:08:21.32928663 +0000 UTC" Pid=20203 ProcessID=24bb9cb09ac52312a0722215ccc4a3cfb6c51d5b68aa4afbc91f491834657a4a containerID=441f968f24e3a8b4043919164c0d4d377178f379535454971b85baf1a473b4c0 module=libcontainerd namespace=moby topic=/tasks/exit

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2021, 4:09pm UTC](https://discuss.elastic.co/t/how-to-collect-dmesg-outputs-or-those-logs-are-useless/262714/4 "2021-03-01T16:09:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.