Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

When I connect a USB drive to an Ubuntu OS, would there be a text file which contains details of that connection and if so, where is that file located ? What is the name of that file?

share|improve this question
add comment

2 Answers

up vote 16 down vote accepted

Does Ubuntu log when USB devices are connected?

Yes, Ubuntu logs when a USB device is connected. The file is /var/log/syslog. You can also view it by issuing the command dmesg -c or graphically using Log file viewer.

Does this file deleted upon shutdown?

No, This log does not get wiped upon shutdown. But after a size limit is reached these are rotated, meaning the new logs are gone in the /var/log/syslog files and older are compressed into files as /var/log/syslog.1.gz or syslog.2.gz in the same /var/log directory.

You can view the /var/log directory with rotated log files below:

enter image description here

share|improve this answer
    
Does this log get wiped upon system shutdown? Or is it down after a particular number of MBs? –  Neil May 25 '12 at 12:34
    
I have edited the answer according to your question –  Anwar Shah May 25 '12 at 12:47
2  
If you want to see exactly what gets logged in realtime, you could tail -f /var/log/syslog, clear the screen, then connect the USB device. –  Nathan Long May 25 '12 at 16:09
add comment

The area I look at is:

sudo cat /var/log/kern.log | grep usb

The output would look like the following:

May 25 07:38:51 mycomputer kernel: [  607.296847] scsi7 : usb-storage 3-1:1.0
May 25 07:38:54 mycomputer kernel: [  609.790892] usb 3-2: new high-speed USB device number 3 using xhci_hcd
May 25 07:38:54 mycomputer kernel: [  609.817462] usb 3-2: ep 0x81 - rounding interval to 32768 microframes, ep desc says 0 microframes
May 25 07:38:54 mycomputer kernel: [  609.817474] usb 3-2: ep 0x2 - rounding interval to 32768 microframes, ep desc says 0 microframes
May 25 07:38:54 mycomputer kernel: [  609.818399] usb-storage 3-2:1.0: Quirks match for vid 13fe pid 3600: 4000
May 25 07:38:54 mycomputer kernel: [  609.818529] scsi8 : usb-storage 3-2:1.0

There are also compressed logs for kern.log You can search those with the following command:

sudo zcat /var/log/kern.log.2.gz | grep usb

The output would be in the same format as the the example above.

You can also search the syslog as follows:

sudo cat /var/log/syslog.1 | grep usb

This gives you results that look like this:

May 25 07:31:25 tardis-w520 kernel: [  161.469096] usb 1-1.5.5: new high-speed USB device number 8 using ehci_hcd
May 25 07:31:25 tardis-w520 mtp-probe: checking bus 1, device 8: "/sys/devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.5/1-1.5.5"
May 25 07:31:25 tardis-w520 kernel: [  161.658587] scsi6 : usb-storage 1-1.5.5:1.0
May 25 07:31:25 tardis-w520 kernel: [  161.658685] usbcore: registered new interface driver usb-storage
May 25 07:31:25 tardis-w520 kernel: [  161.795563] usbcore: registered new interface driver uas
May 25 07:38:51 tardis-w520 kernel: [  607.268280] usb 3-1: new high-speed USB device number 2 using xhci_hcd
May 25 07:38:51 tardis-w520 kernel: [  607.293280] usb 3-1: ep 0x81 - rounding interval to 32768 microframes, ep desc says 0 microframes
May 25 07:38:51 tardis-w520 kernel: [  607.293292] usb 3-1: ep 0x2 - rounding interval to 32768 microframes, ep desc says 0 microframes

To list the .gz log files you would:

sudo zcat /var/log/syslog.2.gz | grep usb

The resulting output would be in the same format as the previous.

If this is for forensics purposes there may be a better way.

share|improve this answer
    
The Kern.log does not get deleted after shutdown. Nor does the syslog. Both get compressed after a while. –  cprofitt May 25 '12 at 13:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.