Is there a way given a device file name to figure out if it was created by some udev rule or it was created "the cold way"?

1 Answer 1


No. Once a device node is created, there's no trace left of what process created it.

At best, you could examine udev rules and determine that a node might have been created by one of the rules, but you can't tell if it actually was created due to the rule.

It may have been created manually at the command line, it may have been created by some other script that ignores udev rules. The device node may have been originally created by udev, but later deleted and re-created by some other method.

  • I see, and I was afraid of that kind of reality. However (putting manual device file recreation aside) shouldn't there be some logs left in the system when udev rule is applied? What about audit events? I mean, it sounds like a flaw in security if e.g. someone could plug-in arbitrary USB stick into a server or someones workstation, and it would be impossible to detect that without physical presence at the scene.
    – Student4K
    May 7, 2021 at 18:46
  • udev doesn't log device-node creation by default. you can increase udev's log level to debug in /etc/udev/udevd.conf (IIRC, the default log level is "info")....and that might show when it creates device nodes (I don't know for sure, because I haven't tested it). But a) you almost certainly don't want to run udev like this all the time because of all the log spew it will generate, and b) it won't tell you if a udev-created device node was deleted and re-created by something else.
    – cas
    May 8, 2021 at 4:45
  • The kernel will log events like USB device insertion and removal. It won't show whether udev created a device node or not, though.
    – cas
    May 8, 2021 at 4:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .