What is a kernel ring buffer?

This article has last been updated at January 6, 2025.

The kernel ring buffer on Linux holds important system events and makes it available to the system administrator. It is maintained by the kernel itself and is stored in memory. The contents of the ring buffer is available to user space, so it can easily be viewed with a tool like dmesg. The kernel will log events to the buffer that are usually related to the boot process, kernel modules being loaded or unloaded, hardware support, systemd activation, firewall events, memory, and serious issues with processes.

Buffer size

The size of the kernel ring buffer is defined during compilation of the kernel itself, so typically your Linux distribution decides an acceptable size. To find this, we need to extract the value of CONFIG_LOG_BUF_SHIFT from the kernel configuration file. This file is typically stored in /boot or /proc.

# grep ^CONFIG_LOG_BUF_SHIFT /boot/config-$(uname -r)
CONFIG_LOG_BUF_SHIFT=17

If the configuration is not available in the /boot, then it might be stored in /proc.

zgrep CONFIG_LOG_BUF_SHIFT /proc/config.gz

This will return a value, like the value 17 above. To turn this into a size, we need to calculate this by using 2 to the power of 17 (2^17), resulting in the number 131072, which means 128 kilobytes.