[arch-general] How to show USB insertion in journal without audit enabled?

[David C. Rankin]

All,

  I'm not sure when this changed, but in the past when I plugged in a USB
flash drive, I could just watch a tail of the journal to see the connection
and device details. I tried that again today and nothing appeared in the
journal, though the device was seen and assigned /dev/sde (and /dev/sde1)
which I got from cat /proc/partitions.

  I have also added the kernel parameter audit=0 per
https://wiki.archlinux.org/index.php/Audit_framework to disable the audit
messages in the journal. I don't recall the USB messages being audit messages
before (they could have been, I just don't remember), but now nothing is shown.

  Is the lack of output in the journal on USB drive plug-in due to the audit=0
parameter, and if so, is there any way to restore the journal messages on USB
plug-in without enabling audit?


-- 
David C. Rankin, J.D.,P.E.