How to Monitor USB and Hardware Events in Real Time Using udevadm in Ubuntu

When troubleshooting peripheral hardware devices, external USB storage drives, serial converters, or network interfaces on an Ubuntu system, connecting a device that fails to appear in lsblk or ip link leaves administrators wondering whether the issue is a faulty physical cable, a missing kernel driver, or an unassigned device node in /dev. While the traditional dmesg buffer logs general kernel outputs, it mixes hardware initialization logs with hundreds of unrelated kernel status messages.

For precise, real-time hardware diagnostics, modern Linux systems rely on udevadm. As the administrative interface for the Linux dynamic device manager (systemd-udevd), udevadm allows you to intercept and inspect kernel uevents and udev rule evaluations the exact split second a device is plugged in or unplugged. In this guide, you will learn how to monitor hardware connection events in real time and extract detailed hardware attributes using udevadm in Ubuntu.

Why Use udevadm for Hardware Troubleshooting?

Monitoring uevents with udevadm provides powerful low-level visibility:

• Real-time event streaming: Instantly displays hardware add, remove, change, and bind events as physical connections occur.
• Extracts exact vendor and product IDs: Uncovers the exact USB Vendor ID (idVendor), Product ID (idProduct), and serial numbers required to write custom persistent udev rules.
• Verifies driver binding: Confirms whether the Linux kernel successfully binds an appropriate driver subsystem (such as usb-storage, cdc_acm, or ftdi_sio).

Step 1: Monitoring Real-Time Hardware Events

To watch device connection events as they happen, open your terminal and launch the udevadm monitor command:

sudo udevadm monitor

Now, physically plug in a USB flash drive, external hard drive, USB mouse, or serial device into your computer. Your terminal will immediately stream real-time uevents:

KERNEL[1254.321] add      /devices/pci0000:00/0000:00:14.0/usb1/1-2 (usb)
UDEV  [1254.345] add      /devices/pci0000:00/0000:00:14.0/usb1/1-2 (usb)
KERNEL[1254.380] add      /devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/host4/target4:0:0/4:0:0:0/block/sdb (block)
UDEV  [1254.490] add      /devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/host4/target4:0:0/4:0:0:0/block/sdb (block)

In this output:

• KERNEL events represent raw notifications sent by the Linux kernel.
• UDEV events represent actions processed by the udev daemon after applying custom naming rules and permissions.

Step 2: Monitoring Environment Variables and Subsystems

To inspect detailed device metadata—including filesystem UUIDs, partition labels, and device node names—add the --environment flag:

sudo udevadm monitor --environment

Plug in your device again. The output will print rich key-value pairs (such as DEVNAME=/dev/sdb1, ID_FS_TYPE=ext4, and ID_SERIAL_SHORT=12345678) that describe the attached device completely.

Step 3: Querying Detailed Attributes of an Existing Device

If a device is already plugged in and you need to inspect all of its hardware properties to write a custom udev rule or mount script, use udevadm info:

udevadm info --query=all --name=/dev/sdb

To walk up the entire parent device hierarchy and inspect vendor IDs, serial numbers, and driver bindings:

udevadm info --attribute-walk --name=/dev/sdb

This command prints every attribute matched by the kernel from the storage block device up to the physical USB host controller.