Manoj Rao bio photo

Manoj Rao

Your Average Common Man

Email Twitter Github

In an earlier post, I had written about detecting a dead USB with a simple script. The summary of that was you have a shell script periodically polling the output of lsusb command to monitor a USB device of your interest.

Unfortunately, the script is not efficient and it is embarrassing to be monitoring constantly in this day and age. Thanks to Grant Vesely for bringing this question up.

There are several ways to do the same, but the most efficient way to do this has to be simply subscribing to a udev event or simply known as a uevent from the Kernel.

What is udev?

udev provides a dynamic device directory containing only the files for actually present devices. It creates or removes device node files usually located in the /dev directory, or it renames network interfaces.

As part of the hotplug subsystem, udev is executed if a kernel device is added or removed from the system. On device creation, udev reads the sysfs directory of the given device to collect device attributes like label, serial number or bus device number. These attributes may be used as keys to determine a unique name for the device. udev maintains a database for devices present on the system. On device removal, udev queries its database for the name of the device file to be deleted. Refer to the man page for udev

How do you udev?

The udev daemon, systemd-udevd (or systemd-udevd.service) communicates with the kernel and receives device uevents directly from it each time you add or remove a device from the system, or a device changes its state.

Udev is based on rules, they are flexible and powerful. Every received device event is matched against the set of rules read from files located in /lib/udev/rules.d and /run/udev/rules.d.

You can write custom rules files in the /etc/udev/rules.d/ directory (files should end with the .rules extension) to process a device. Note that rules files in this directory have the highest priority.

udev Monitor

We can monitor all the udev events in the Kernel from user space using the following command.

udevadm monitor

How to Detect a Dead USB with udev?

Create Actions for Connection and Disconnection

For USB Connection, the action taken could simply be to log it

$ cat ~/usb_add_scream

echo "USB inserted at $(date)" >> /tmp/usb_disc.log

On Disconnection event, the action taken could be to log the time of disconnection.

$ cat ~/usb_remove_scream

echo "USB disconnected at $(date)" >> /tmp/usb_disc.log

Rules to Trigger Actions

udev allows you to create rules. These rules for my USB mouse look like this:

SUBSYSTEM=="usb", ACTION=="add", ENV{DEVTYPE}=="usb_device", ATTR{idVendor}=="045e", RUN="/home/manoj/usb_add_scream"
SUBSYSTEM=="usb", ACTION=="remove", ENV{DEVTYPE}=="usb_device", RUN="/home/manoj/usb_remove_scream"

Setting up these rules automatically trigger the action when the rules are satisfied. In particular, the rule checks for usb subsystem’s action for add or remove of a USB device type. If this rule is satisfied then it RUNs the script for action (needs to have execute permissions)

╰─ lsusb| grep 045e
Bus 001 Device 036: ID 045e:07fd Microsoft Corp. Nano Transceiver 1.1
╰─ cat /tmp/usb_disc.log 

Then I disconnect the mouse connected over a USB hub.

╰─ lsusb| grep 045e
╰─ cat /tmp/usb_disc.log 
USB disconnected at Fri Jan 24 23:33:19 PST 2020
USB disconnected at Fri Jan 24 23:33:19 PST 2020
╰─ lsusb| grep 045e     
Bus 001 Device 037: ID 045e:07fd Microsoft Corp. Nano Transceiver 1.1
╰─ cat /tmp/usb_disc.log
USB disconnected at Fri Jan 24 23:33:19 PST 2020
USB disconnected at Fri Jan 24 23:33:19 PST 2020
USB inserted at Fri Jan 24 23:33:42 PST 2020
USB inserted at Fri Jan 24 23:33:42 PST 2020


This method does not require any CPU for constantly monitoring, neither does it take any other resource than to handle an in-memory notification from the kernel to the user space. This is the basis for sysfs entries to show relevant device information.

My Podcast!

If you like topics such as this then please consider subscribing to my podcast. I talk to some of the stalwarts in tech and ask them what their favorite productivity hacks are:

Available on iTunes Podcast

Visit Void Star Podcast’s page on iTunes Podcast Portal. Please Click ‘Subscribe’, leave a comment.

Get it iTunes

Available on Google Play Music

Visit Void Star Podcast’s page on Google Play Music. Please Click ‘Subscribe’ and leave a comment.

Listen on Google Play Music
Available on Stitcher

Visit Void Star Podcast’s page on Sticher. Please Click ‘Subscribe’ and leave a comment.

Listen to Stitcher

Your app not listed here? Not an issue..

You should be able to search for ‘VoidStar Podcast’ on your favorite app. Most apps use one of the above sources for listing podcasts. This was tested on Podcast Addict (where you can also specify the search engine) and RatPoison on Android.