There are two well-known message buses: the systemwide message bus (installed on many systems as the "messagebus" service) and the per-user-login-session message bus (started each time a user logs in). The --system and --session options direct dbus-monitor to monitor the system or session buses respectively. If neither is specified, dbus-monitor monitors the session bus.

dbus-monitor has two different text output modes: the 'classic'-style monitoring mode, and profiling mode. The profiling format is a compact format with a single line per message and microsecond-resolution timing information. The --profile and --monitor options select the profiling and monitoring output format respectively.

dbus-monitor also has two binary output modes. The binary mode, selected by --binary, outputs the entire binary message stream (without the initial authentication handshake). The PCAP mode, selected by --pcap, adds a PCAP file header to the beginning of the output, and prepends a PCAP message header to each message; this produces a binary file that can be read by, for instance, Wireshark.

If no mode is specified, dbus-monitor uses the monitoring output format.

In order to get dbus-monitor to see the messages you are interested in, you should specify a set of watch expressions as you would expect to be passed to the dbus_bus_add_match function.

The message bus configuration may keep dbus-monitor from seeing all messages, especially if you run the monitor as a non-root user.