What is the flow of USB events from kernel space to user space? I get a popup on my desktop when I plug in a USB drive -- what is the sequence of events that leads from detecting the new USB drive to mounting it and showing that popup?

2 Answers 2


This is handed by udev on modern Linux systems. The udev daemon started with the system will search in /etc/udev/rules.d and /lib/udev/rules.d and will run matching rules for kernel events. Inserting a USB drive will trigger an event, udev will search for a matching rule and will execute it.

The rules themselves will determine what your system does. In recent years, udev has communicated to HAL, which would alert applications via DBUS. This approach is now obsolete in favor of a unified udev solution, which I presume will involve udevd communicating via dbus directly, or via dbus-send.

You can monitor the activities of udev via udevadm monitor.


I'm not completely confident with this yet, so take it with a grain of salt and more research.

It starts with the kernel hotplug subsystem. After a device is setup, it either calls whatever userspace program is setup to handle hotplug events (if one was set by echo hotplug_handler > /proc/sys/kernel/hotplug) or sends a data packet over the kobject_uevent netlink socket. When the kernel launches the hotplug handler, it sets up some environment variables. When the kernel sends a datapacket, it includes key=value pairs. If you want to, you can setup a script that just logs the environment and set it up as the handler (not on your production system, of course - a test setup).

Usually, udev is setup as the handler, and it will have several rules setup about how to handle events. From there, it can launch other programs that do other things (like issue dbus messages). These udev rules are highly dependent on the particular distribution of interest.

There is a lot of information in this thread where someone is trying to write some documentation - note the first message is not accurate; keep reading.

  • 3
    Once upon a time this was accurate, but not for a long time now: modern udev listens for uevents on a netlink socket. (The old way had serialization/concurrency issues.)
    – ephemient
    Jan 11, 2011 at 0:06
  • Since I am new to this part of Linux(udev, hotplug), I would like to have idea on every line you have described here. So could you please elaborate on starts with the kernel hotplug subsystem. Jan 11, 2011 at 4:59
  • @ephemient: Thanks for the reply. Could you please explain the sequence of events. Jan 11, 2011 at 5:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.