How to Inspect System Devices, Drivers, and Bus Topology in Linux Using systool

The Linux kernel exposes hardware devices, buses, drivers, and power parameters through the virtual /sys filesystem (sysfs). While navigating sysfs directories manually using cat and ls provides granular visibility, inspecting deeply nested device hierarchies quickly becomes tedious during diagnostics. The systool command, provided by the sysfsutils suite, parses sysfs data and formats devices, drivers, and buses into clean, readable terminal trees.

Installing the sysfsutils Suite

Most minimal Linux server distributions do not include systool by default. The command is packaged within the standard sysfsutils repository package across major distributions.

To install sysfsutils on Ubuntu or Debian systems, update the package cache and install the binary:

sudo apt update
sudo apt install sysfsutils -y

On RHEL, Rocky Linux, or Fedora, install the package using dnf:

sudo dnf install sysfsutils -y

On Arch Linux, install it via pacman:

sudo pacman -S sysfsutils

Verify the installation by querying the utility version:

systool -v

Viewing Available System Buses and Devices

The -b flag instructs systool to query a specific bus subsystem, such as PCI, USB, SCSI, or I2C. Running the command without additional flags lists all registered buses recognized by the kernel:

systool -b

To view all physical and virtual devices attached to the PCI bus, execute:

systool -b pci

To inspect devices attached to the USB subsystem, run:

systool -b usb

Adding the -v (verbose) flag displays every sysfs attribute associated with each device on the bus, including vendor IDs, product IDs, subsystem IDs, and power states:

systool -b pci -v

Because verbose output generates hundreds of lines across complex motherboards, pipe the command into a pager or filter for specific devices:

systool -b pci -v | less

Inspecting Kernel Drivers and Module Attributes

Device troubleshooting frequently requires verifying which kernel driver manages a device and what operational parameters are active. The -m flag queries loaded kernel modules and their runtime parameters exposed in /sys/module.

To inspect a loaded kernel module, pass the module name to systool:

systool -m e1000e -v

The verbose output details parameters, module state, memory layout sections, and kernel references:

Module = "e1000e"

  Attributes:
    coresize            = "335872"
    initsize            = "0"
    initstate           = "live"
    refcnt              = "0"
    srcversion          = "5B9741A17C0C75D18FE6102"
    taint               = ""
    uevent              = <store method only>

  Parameters:
    copybreak           = "256"
    debug               = "0"
    IntMode             = "1"
    SmartPowerDownEnable= "0"

  Sections:
    .altinstructions    = "0xffffffffc085e000"
    .bss                = "0xffffffffc0864000"
    .data               = "0xffffffffc0862000"
    .rodata             = "0xffffffffc085b000"
    .text               = "0xffffffffc0847000"

To inspect device drivers registered across all buses rather than modules, use the -d flag:

systool -d nvme -v

Querying Device Classes and Subsystems

Devices in Linux are categorized into functional classes under /sys/class, such as net for network interfaces, block for disk storage, drm for graphics cards, and power_supply for battery and AC adapters. The -c flag queries entire device classes.

To inspect all network interfaces and their hardware attributes, run:

systool -c net -v

This command reveals physical MAC addresses, operational states, MTU values, queue counts, and interface duplex modes directly from the kernel driver:

Class = "net"

  Class Device = "eth0"
  Class Device path = "/sys/devices/pci0000:00/0000:00:03.0/net/eth0"
    addr_assign_type    = "0"
    addr_len            = "6"
    address             = "52:54:00:12:34:56"
    carrier             = "1"
    dormant             = "0"
    duplex              = "full"
    flags               = "0x1003"
    ifindex             = "2"
    link_mode           = "0"
    mtu                 = "1500"
    operstate           = "up"
    speed               = "1000"
    tx_queue_len        = "1000"
    type                = "1"

To audit block storage devices, including NVMe drives, SATA disks, and loop devices, execute:

systool -c block -v

To check battery and power adapter telemetry on laptops or uninterruptible power supply (UPS) setups, inspect the power_supply class:

systool -c power_supply -v

Filtering and Scripting with systool

Because systool produces structured hierarchical output with consistent indentation, it integrates cleanly into bash automation scripts and reporting pipelines. For example, to extract the assigned MAC address and link speed of all network adapters:

systool -c net -v | awk '/Class Device =/ {dev=$4} /address / {mac=$3} /speed / {print dev, mac, $3" Mbps"}'

To audit which PCI devices have runtime power management enabled:

systool -b pci -v | grep -E "(Device =|control )"

Using systool provides a reliable, read-only mechanism to query kernel hardware states without relying on distribution-specific GUI utilities or manually parsing raw sysfs paths.