Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm working on a script which runs on various types of CentOS/Redhat servers where it needs to find out which files were loaded into the kernel. Running lsmod provides me with the name of the module (which may be set using -o in the call to insmod) but not the file that was loaded.

Is there anyway to find out which files were loaded into the kernel as modules? Preferably, with the ability to cross reference with the name as it appears in lsmod?

Thanks!

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

This information is not recorded anywhere, as far as I know. Even if it was, the information might not be accurate if the file was moved or removed in the meantime (which would explain why no one implemented such a feature).

Given a module name foo, modprobe -l foo shows what file would now be loaded if the module foo was requested. But if modprobe -o bar was used to load a module, the default module name is not recorded, only bar.

share|improve this answer
    
I come from a Windows background - where such files are normally easy to identify and usually locked for access (moving, renaming, etc.). Does the kernel hold any file descriptors to the files it loaded (after loading them)? Or maybe logs by default which files were loaded and under what names? –  Yon Sep 1 '10 at 6:10
    
@Yon: The kernel itself never opens a file. insmod and modprobe work by loading the code from the .ko file into memory and passing that in-memory copy to the kernel. Then the kernel keeps its own copy of the code. If you need this information, you'll need to keep your own logs (and make sure you don't delete or move the module files, for example by doing a kernel upgrade). Note that this is a general philosophy in the unix world: renaming or removing files is supposed to always work, and not cause trouble unless something later tries to open the file. –  Gilles Sep 1 '10 at 7:37
    
Thank you for this. We'll find another solution. In accordance with this site's regulations, is an answer which says "that's not possible" considered to be a good answer to a question (if it's a true answer? –  Yon Sep 1 '10 at 14:29
    
@Yon: I can hardly answer this since I'm an interested party. Check the FAQ regarding accepted answers, and if you still can't decide, look on meta and SO meta or ask on meta. –  Gilles Sep 1 '10 at 18:40
    
Well, according to the FAQ it should be the "most helpful" answer. –  Yon Sep 2 '10 at 9:47
add comment

I've been playing a bit and found the following commands.

$ lsmod | cut -d " " -f 1

will output a list of loaded modules.

$ modinfo modulename -n

will output the filename of the module.

$ list=`lsmod | cut -d " " -f 1`; echo "$list" | while read line; do echo $line; echo -e `modinfo $line -n`\\n; done;

will output a list of the kernel modules, along with its file path.

share|improve this answer
1  
But modinfo doesn't help if the module was loaded with an alternate name with modprobe -o or if the module file was renamed. –  Gilles Aug 31 '10 at 20:28
    
@Gilles True, +1 –  BloodPhilia Aug 31 '10 at 20:42
    
@Gilles And that exactly is the situation here, so after testing what @BloodPhilia suggested we're still without an answer. –  Yon Sep 1 '10 at 5:58
add comment
cat /proc/modules

gives you the list (detailed) of the loaded modules (RedHat, Ubuntu, I guess it works for CentOS from which Redhat is based).

share|improve this answer
    
@ring0: That is indeed a simple way to find modules classified by the name under which they were loaded. But it doesn't help if the load name does not match the file name due to the use of modprobe -o. –  Gilles Sep 1 '10 at 18:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.