4

I'm working on a script which runs on various types of CentOS/Redhat servers where it needs to find out which files were loaded into the kernel. Running lsmod provides me with the name of the module (which may be set using -o in the call to insmod) but not the file that was loaded.

Is there anyway to find out which files were loaded into the kernel as modules? Preferably, with the ability to cross reference with the name as it appears in lsmod?

Thanks!

Improve this question

4 Answers 4

Reset to default
3

This information is not recorded anywhere, as far as I know. Even if it was, the information might not be accurate if the file was moved or removed in the meantime (which would explain why no one implemented such a feature).

Given a module name foo, modprobe -l foo shows what file would now be loaded if the module foo was requested. But if modprobe -o bar was used to load a module, the default module name is not recorded, only bar.

Improve this answer
5
  • I come from a Windows background - where such files are normally easy to identify and usually locked for access (moving, renaming, etc.). Does the kernel hold any file descriptors to the files it loaded (after loading them)? Or maybe logs by default which files were loaded and under what names?
    – Yon
    Sep 1, 2010 at 6:10
  • 1
    @Yon: The kernel itself never opens a file. insmod and modprobe work by loading the code from the .ko file into memory and passing that in-memory copy to the kernel. Then the kernel keeps its own copy of the code. If you need this information, you'll need to keep your own logs (and make sure you don't delete or move the module files, for example by doing a kernel upgrade). Note that this is a general philosophy in the unix world: renaming or removing files is supposed to always work, and not cause trouble unless something later tries to open the file.
    – Gilles 'SO- stop being evil'
    Sep 1, 2010 at 7:37
  • Thank you for this. We'll find another solution. In accordance with this site's regulations, is an answer which says "that's not possible" considered to be a good answer to a question (if it's a true answer?
    – Yon
    Sep 1, 2010 at 14:29
  • @Yon: I can hardly answer this since I'm an interested party. Check the FAQ regarding accepted answers, and if you still can't decide, look on meta and SO meta or ask on meta.
    – Gilles 'SO- stop being evil'
    Sep 1, 2010 at 18:40
  • Well, according to the FAQ it should be the "most helpful" answer.
    – Yon
    Sep 2, 2010 at 9:47
1

I've been playing a bit and found the following commands.

$ lsmod | cut -d " " -f 1

will output a list of loaded modules.

$ modinfo modulename -n

will output the filename of the module.

$ list=`lsmod | cut -d " " -f 1`; echo "$list" | while read line; do echo $line; echo -e `modinfo $line -n`\\n; done;

will output a list of the kernel modules, along with its file path.

Improve this answer
3
  • 2
    But modinfo doesn't help if the module was loaded with an alternate name with modprobe -o or if the module file was renamed.
    – Gilles 'SO- stop being evil'
    Aug 31, 2010 at 20:28
  • @Gilles True, +1
    – Pylsa
    Aug 31, 2010 at 20:42
  • @Gilles And that exactly is the situation here, so after testing what @BloodPhilia suggested we're still without an answer.
    – Yon
    Sep 1, 2010 at 5:58
0 
cat /proc/modules

gives you the list (detailed) of the loaded modules (RedHat, Ubuntu, I guess it works for CentOS from which Redhat is based).

Improve this answer
1
  • @ring0: That is indeed a simple way to find modules classified by the name under which they were loaded. But it doesn't help if the load name does not match the file name due to the use of modprobe -o.
    – Gilles 'SO- stop being evil'
    Sep 1, 2010 at 18:41
-3

cat /proc/modules
more /proc/modules

Image sudo rmmod print

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .