[arch-general] How to show USB insertion in journal without audit enabled?
David C. Rankin
drankinatty at suddenlinkmail.com
Sun Apr 19 01:19:18 UTC 2020
I'm not sure when this changed, but in the past when I plugged in a USB
flash drive, I could just watch a tail of the journal to see the connection
and device details. I tried that again today and nothing appeared in the
journal, though the device was seen and assigned /dev/sde (and /dev/sde1)
which I got from cat /proc/partitions.
I have also added the kernel parameter audit=0 per
https://wiki.archlinux.org/index.php/Audit_framework to disable the audit
messages in the journal. I don't recall the USB messages being audit messages
before (they could have been, I just don't remember), but now nothing is shown.
Is the lack of output in the journal on USB drive plug-in due to the audit=0
parameter, and if so, is there any way to restore the journal messages on USB
plug-in without enabling audit?
David C. Rankin, J.D.,P.E.
More information about the arch-general