Kernel Logs

The Kernel Ring Buffer (dmesg)

While logd handles user-space logging, the Linux kernel maintains its own logging system called the kernel ring buffer. This buffer captures low-level hardware initialization, driver messages, and critical kernel events (like panics or Out-Of-Memory kills).

You can read the kernel ring buffer using the dmesg command.

adb shell dmesg

To continuously monitor the kernel log:

adb shell dmesg -w

Kernel Log Levels

Similar to Android's logcat, the kernel assigns log levels to its messages:

• 0: Emergency
• 1: Alert
• 2: Critical
• 3: Error
• 4: Warning
• 5: Notice
• 6: Informational
• 7: Debug

In C code within the kernel, these are used via the printk function:

printk(KERN_ERR "MyDriver: Failed to initialize hardware.\\n");

Reading Kernel Panics

A kernel panic occurs when the kernel encounters a fatal error it cannot recover from. When this happens, the system crashes and typically reboots immediately. The panic message is written to the ring buffer.

If you suspect a hardware or deep driver issue, searching dmesg for panics is the first step:

adb shell dmesg | grep "Kernel panic"

Persistent Kernel Logs via pstore

If the kernel panics, the device reboots before you can run dmesg. To solve this, Android utilizes the Linux pstore (persistent storage) subsystem.

When a panic occurs, the kernel attempts to flush the last several kilobytes of the ring buffer (and sometimes the CPU register state) to a persistent RAM region (ramoops) or a dedicated partition.

After the device reboots, you can extract the panic logs from the sysfs interface:

adb shell ls -l /sys/fs/pstore/
adb shell cat /sys/fs/pstore/console-ramoops-0
adb shell cat /sys/fs/pstore/dmesg-ramoops-0

These ramoops files are critical for root-causing random reboots reported by users in the field.