Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have a system that backs up my Linux server onto a USB storage device on /media/usb. This all works correctly. However, I actually have 2 drives which we try to swap on a daily basis.

Is there anyway of logging when a USB device was plugged in and a way of using sendmail or something similar to send an email to the administrator if the drive hasn't been swapped for 3+ days for example?

share|improve this question

migrated from Jun 18 '12 at 9:33

This question came from our site for professional and enthusiast programmers.

I'm not sure if this question is off topic or not, but maybe you could try asking at SuperUser? – David Jun 18 '12 at 8:30
up vote 6 down vote accepted

You could parse /var/log/messages, but I wouldn't.

I'd write a udev rule that ran a script when you connect/disconnect the device. There's some more information on it here

I've copied the salient points in case that site goes down:

Rule files are stored in the /etc/udev/rules.d/ directory.

There's some advice from the README in that directory on how to name rule files:

Files should be named xx-descriptive-name.rules, the xx should be chosen first according to the following sequence points:

< 60 most user rules; if you want to prevent an assignment being overriden by default rules, use the := operator.

these cannot access persistent information such as that from vol_id

< 70 rules that run helpers such as vol_id to populate the udev db

< 90 rules that run other programs (often using information in the udev db)

=90 rules that should run last

The first part of a udev rule is the matching keys. We will use the KERNEL entry from the very top of the chain as well as the idVendor, idProduct, and serial attributes from the device specific information. This will positively identify this particular thumb drive and ignore all others. The kernel argument uses a question mark as a wild card so that if our drive were mounted on a different node (ie: sda1, sdb1, sdc1, etc.) it could still be identified.

KERNEL=="sd?1", ATTRS{idVendor}=="13fe", ATTRS{idProduct}=="1f00",

Now that we have the keys necessary to identify the particular hardware we’re looking for we can add assignment arguments. In our case we added two. The first creates a symlink to this device inside of the /dev/ directory. The second executes a script in our home directory:

SYMLINK+="hackaday", RUN+="/home/mike/ 'HackaDay Thumbdrive:' 'Connected as: $KERNEL'" 

Here is the final rule assembled into one line:

KERNEL=="sd?1", ATTRS{idVendor}=="13fe", ATTRS{idProduct}=="1f00", ATTRS{serial}=="50E6920B000AE8", SYMLINK+="hackaday", RUN+="/home/mike/ 'HackaDay Thumbdrive:' 'Connected as: $KERNEL'" 

We added this as the only line in our rule file and then restarted udev using these commands:

sudo nano /etc/udev/rules.d/81-thumbdrive.rules 
sudo /etc/init.d/udev restart
share|improve this answer
Thanks! I ran with this and it works brilliantly. I just used UDEV to store a time the drive was swapped and in my backup script, it checks that file and pings off and email if it doesn't match my criteria! – Schodemeiss Jun 19 '12 at 8:43
Would it make sense to somehow get udev events and log them into journald? – CMCDragonkai Jul 14 '14 at 7:42

Yes, every time you plug in or disconnect and USB device, a message (or messages) is (are) written in the /var/log/messages. You can easily check those out using the command dmesg. It wouldn´t be entirely unreasonable to poll that file every (x) units of time to check for connect/disconnect messages and act accordingly.

share|improve this answer

protected by Sven Apr 13 '14 at 8:44

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.