Calculate dmesg kernel ring buffer size and message retention capacity.
The kernel's printk ring buffer (sized by the log_buf_len boot parameter, typically 128KB-1MB depending on distro and hardware) holds recent kernel messages viewable with `dmesg`. It's a fixed-size circular buffer — once full, new messages overwrite the oldest ones, so a burst of kernel messages (driver errors, OOM killer activity, hardware faults) can wrap and permanently lose earlier context within seconds if the buffer is small and the message rate is high. Whether that loss actually matters depends on whether journald (or another log forwarder) has already persisted a copy to disk before the wrap occurs.
Buffer capacity
max_lines_held = log_buf_len_bytes / avg_line_size; seconds_until_wrap = max_lines_held / messages_per_sec
`dmesg -s <bytes>` sets the read buffer size for the dmesg command itself, but the kernel's actual ring buffer size is set at boot via the `log_buf_len=<size>` kernel parameter (e.g. in GRUB config) and cannot be resized at runtime — you can only view/consume what the kernel already allocated.
On systems with heavy early-boot kernel logging (many drivers, verbose debug settings) combined with a small log_buf_len, the ring buffer can wrap before userspace even starts, silently losing the earliest boot messages — increasing log_buf_len via kernel boot parameter is the fix if early-boot diagnostics matter.
journald reads the kernel ring buffer at startup (capturing whatever's currently in it) and then continues forwarding new kernel messages as they arrive via the kmsg device, so if journald starts late (or the buffer wrapped before journald could read it), some very early messages are lost from both dmesg and the journal permanently.