2

We have a USB pen drive connected to our server. It was connected months ago so we the log of the initial connection have since been rotated out.

I know you could obtain the make and model of a device (e.g., /dev/sdc) from the /var/log/messages log messages. However, how would we be able to obtain that without access to the logs?

Belmin Fernandez
  • 10,629
  • 26
  • 84
  • 145

4 Answers4

4

The lsusb command may be helpful (assuming the device is still connected).

Update: The original question asked for the make/model which is not /dev/sdc that confused me (lsusb should have shown the make/model). You could use the sg_scan and sg_map commands:

# sg_map
/dev/sg0   /dev/sda
/dev/sg1   /dev/scd0
/dev/sg3   /dev/sdc

Now we know that /dev/sdc maps to /dev/sg3 use 

# sg_scan -i
...
/dev/sg3: scsi10 channel=0 id=0 lun=0
   Verbatim STORE N GO PMAP [rmb=1 cmdq=0 pqual=0 pdev=0x0]

You will need the sg3_utils rpm installed for access to the sg utils.

Finally, for joechip, the udisks --dump command can show you the link between usb/scsi. Look for native-path.

native-path:   /sys/devices/pci0000:00/0000:00:1a.7/usb1/1-4/1-4:1.0/host10/target10:0:0:/block

and device:

device: 8,32

Not pleasant to look at but there if you need it.

gm3dmo
  • 9,632
  • 1
  • 40
  • 35
  • How would I tie that to a disk device though? – Belmin Fernandez Jul 11 '11 at 00:33
  • Yes, lsusb is useful but still AFAIK obtaining the kernel-name associated to each usb device is not a well-defined process (at least not using command-line utilities and /proc/sys files). For HID devices there is a file called "dev" which tells the major:minor device numbers of the kernel name. But for USB storage devices there doesn't seem to be such thing. Anybody please correct me if I'm wrong. – joechip Jul 11 '11 at 01:46
1

If it's still plugged in, dmidecode may give you the info, or you may find something buried in /proc. If you mean was plugged in months ago and has since been removed, then logs are probably your only choice.

David
  • 3,519
  • 21
  • 17
0

I don't have a complete answer, but if you don't have access to the log files you might still be able to run dmesg and identify the /dev/sd* device that has been associated to the usb-storage device upon plugging it. Unless such information has been flushed from dmesg by now, of course.

joechip
  • 668
  • 3
  • 6
0

In addition to dmidecode as suggested previously...

$ cat /proc/bus/usb/devices
# lshw
uzzi09
  • 193
  • 5