DEV Community

Naval Kishor Upadhyay
Naval Kishor Upadhyay

Posted on

Udev and Device Events: What Happens When You Plug In a USB

#linux #devops #beginners

When you connect a USB stick or external drive to a Linux system, the response feels almost magical: the system recognizes the device, mounts it, and sometimes even opens a file manager window.

Behind the scenes, however, there is a well-orchestrated chain of kernel events, daemons, and device nodes working together. The central actor here is udev — the Linux device manager.

1) Kernel Detection

  • Event trigger: The moment you insert the USB stick, the USB controller hardware signals the kernel that a new device has been attached.
  • Driver binding: The kernel checks its list of drivers to see if it has a suitable one for the device. If not, it may try to load a module dynamically.
  • Kernel role: This entire step happens in kernel space, where hardware is directly managed.

2) Uevent Generation

  • Once the kernel has recognized the device, it generates a uevent (short for user event).
  • The uevent contains important information, including:
    • Vendor and product IDs.
    • The type of device (e.g., storage, input).
    • The device’s connection path.
  • This event is the kernel’s way of telling user space: “A new device is here.”

3) Udev Daemon (udevd)

  • In user space, the udevd daemon constantly listens for these uevents.
  • Its responsibilities include:
    • Parsing the uevent details.
    • Applying any preconfigured udev rules.
    • Creating or removing the appropriate device nodes under /dev.
  • Example: When a USB drive is plugged in, udev creates entries such as /dev/sdb and /dev/sdb1.

4) Device Node Creation in /dev

  • Device nodes are special files that act as communication channels to the hardware.
  • For a USB stick, these nodes typically appear as:
    • /dev/sdb → the whole device.
    • /dev/sdb1 → the first partition on that device.
  • Applications can now interact with the USB device just like they would with a normal file.

5) Higher-Level User Space Actions

  • After device nodes are created, higher-level processes may take over.
  • On desktop systems:
    • Automount services (e.g., udisks2) can mount the device automatically.
    • A file manager may open to show the new USB contents.

  • On servers without a GUI:

    • Manual mounting is common: 
    sudo mount /dev/sdb1 /mnt/usb

6) Monitoring Device Events

  • You can observe these steps in real time using: 
  udevadm monitor
Enter fullscreen mode Exit fullscreen mode
  • This shows:
    • Kernel uevents as they are generated.
    • Udev’s actions in response (such as creating device nodes).
  • This is a powerful way to troubleshoot if a device does not appear as expected.

7) Why This Matters

  • Consistency: Every device follows the same flow — kernel detects, uevent is sent, udev processes it, and /dev entries are created.
  • Flexibility: System administrators can write udev rules to automate tasks, such as running a backup script when a specific USB drive is inserted.
  • Automation: Users don’t have to configure devices manually; the system handles the process in real time.

Final Takeaway

When you plug in a USB device, Linux follows a structured sequence:

  1. The kernel detects the hardware.
  2. A uevent is generated with device details.
  3. The udev daemon listens and creates device nodes.
  4. Higher-level processes mount the device or launch user-friendly actions.

This flow demonstrates the elegance of Linux: the kernel manages detection, while udev manages user-space handling, giving us a consistent and automated hardware experience.

Top comments (0)