udev Device Management (203.4)

Candidates should understand device detection and management using udev. This objective includes troubleshooting udev rules.

Key Knowledge Areas:

The following is a partial list of used files, terms, and utilities:

udev consists of a userspace daemon ( udevd ) which receives uevents from the kernel. It, based on configurable rules which match these uevents, provides a dynamic device directory containing only the files for actually present devices. Communication between the userspace daemon and the kernel is done through the sysfs pseudo filesystem.

udev was designed to make Linux device handling more flexible by taking device handling out of the kernel into userspace. Its configuration rules have a very flexible syntax. You can for example instruct udev to execute a program upon a uevent, or specify your own device naming scheme.


The /etc/udev/ directory contains the configuration and rule files for the udev utility. The file udev.conf is the main configuration file for udev. Here, for instance, the logging priority can be changed.

udev rules

udev rules are read from files located in the default rules directory /lib/udev/rules.d/ . Custom rules to override these default rules are specified in the /etc/udev/rules.d/ directory. This holds true for some distributions, other distributions only have the /etc/ udev/rules.d/ directory

When devices are initialized or removed, the kernel sends an event called 'uevent'. These uevents contain information such as the subsystem (net, usb, ...), action (add, remove) and attributes (MAC address, vendor, ...). udev listens to these events, matches the uevent information to the specified rules, and responds accordingly.

A udev rule consists of multiple key value pairs separated by a comma. Each key value pair represents either a match key (matching to the information in the uevent) or an assign key (these assign values, names and actions to the device nodes maintained by udev):

					SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:21:86:9e:c2:c4",
					ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

The rule specified above, would add a device /dev/eth0 for a network card with MAC address 00:21:86:9e:c2:c4.

As shown, a key value pair also specifies an operator. Depending on the used operator, different actions are taken. Valid operators are:

==Compare for equality
!=Compare for inequality
=Assign a value to a key. Keys that represent a list, are reset and only this single value is assigned
+=Add the value to a key that holds a list of entries
:=Assign a value to a key finally; disallow any later changes, which may be used to prevent changes by any later rules

When specifying rules, be careful not to create conflicting rules (ie, don't point two different network cards to the same device name). Also, changing device names into something else could cause userspace software incompatibilities.


udevmonitor will print udev and kernel uevents events to standard output. You can use it to analyze event timing by comparing the timestamps of the kernel uevent, and the udev event.

Usually udevmonitor is a symbolic link to udevadm. In some distributions, this symbolic link no longer exists. To access the monitor on these systems, use the command udevadm monitor .

Copyright Snow B.V. The Netherlands