Troubleshooting Mac OS X Kernels w/ dmesg

The first thing that loads in OS X is the kernel. The kernel is how users interface with hardware and sets the stage for interaction by probing for each driver that needs to be loaded and tracking what is found. The presence of everything about the system is tracked when the kernel loads as well as pertinent boot parameters. Even if you’re booting in verbose mode, most of this probably happens too fast to notice. You might be able to pause it, but you’re still trying to react to things too quickly in many cases. That’s where the dmesg command comes into play, which lets you review and control the messages since the system has booted.

The dmesg command also looks at some diagnostic messages after the system is due booting, such as when a new interface is detected.┬áThe dmesg command allows for more than what you can see in console, except explicitly for I/O related kernel messages after boot, rather than all the pesky OS stuff you might otherwise see, such as snarky little “spotlight can’t index this or that” kind of errors. Instead, dmesg output is only a few screens, easily readable that focuses on the system hardware & I/O interfaces.

Using dmesg is pretty easy. Even if you’ve su’d, you need to run sudo in front of it each time, but there’s no need for any parameters:

sudo dmesg

You can use -n for the level of errors or -s to constrain the buffer size, but in Mac OS X you likely don’t need to do either as there’s not a ton of information. If you’re looking for something specific, such as information on an AirPort interface, just grep it out:

sudo dmesg | grep AirPort

Overall, dmesg is helpful for stuff like this:

vnic0: promiscuous mode enable failed

Apparently, Rajesh Koothrappali couldn’t find any booze…

Or this:

USBF: 23952.350 AppleUSBEHCI[0xffffff800b7dc000]::Found a transaction which hasn't moved in 5 seconds on bus 0xfd, timing out! (Addr: 4, EP: 2)

I had a bad drobo on the system… Which I might have known by the fact that the Finder froze when plugged in. But I always like to see it in the logs. Swap out one drive, message goes away, drobo loads just fine. Have I mentioned recently I’m liking the low end drobos less and less…

3 Comments

  • Perttu Aaltonen
    June 15, 2012 - 11:24 am | Permalink

    I’ve seen my share of Drobos hang as well. The Finder comes completely unresponsive and some applications refuse to start.

    The latest one coincided with a launchDaemon running ‘serveradmin settings [service]‘ commands. When run manually they finish but from launchd they hang and never finish. At the same time Drobo hangs and can’t be unmounted. Weird part is that ‘serveradmin’ doesn’t even write to that disk but maybe ‘serveradmin’ queries information about the disk. After this I can’t successfully start, for example, Activity Monitor which becomes a zombie process along with ‘serveradmin’. Only a hard reboot helps at that point.

    There could be something else at play there but I’ve seen Drobos hang completely in other situations as well. Also, Crashplan might not realize the disk is not working because it’s not missing, it’s blocked. So the hang might go unnoticed. Crashplan sends and error email only after Drobo is rebooted.

    So…definitely not recommending low end Drobos for business use.

  • Sharone
    August 3, 2012 - 1:36 pm | Permalink

    Hi Charles, thank you for this post. I’m hoping it will help me figure out what I’m trying to do.

    I need to monitor whether external devices have been in & out of my Mac without my knowledge for security reasons. It’s a strange scenario but at times I leave my Ext.HDD plugged in and I’ll go run errands but I suspect someone might be unplugging the drive.
    Is there anyway dmesg monitors device logs?

    • August 3, 2012 - 8:56 pm | Permalink

      There are a few ways you could handle something like this. You could watch /Volumes w/ fsevents and send an email from the LaunchDaemon when something shows up in that folder. You could also disable diskarbitrationd, which would cause you to have to manually mount volumes. Also, Faronics used to make some software that would let you know when a new disk was inserted, but I don’t see it listed on their website any more – might be worth calling them to see if they still make it. I don’t think dmesg is the way to go with something like this, but I do think it’s not an arduous undertaking.

  • Comments are closed.