Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

apologies in advance for the basic question.

I need to identify the log of mounted/unmounted devices in Unix (including the timestamps when these actions where performed).

I noticed that using the mount command is not very helpful for this purpose, since there is no indication of the timestamps when the mount/unmount operations where performed. Can anyone indicate me a possible alternative?

Thank you in advance! :-)

share|improve this question

migrated from Jul 4 '13 at 16:33

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Karan, Heptite, Kevin Panko, Moses, AthomSfere Apr 14 '14 at 10:49

This question was marked as an exact duplicate of an existing question.

Hi, welcome to SO. However, your question is really better suited to SuperUser, the site for computer administration questions. – Hong Ooi Jul 4 '13 at 16:27
Ok I will post my question also to the Superuser forum. – user2551168 Jul 4 '13 at 16:31
No, wait - ask for this one to be migrated instead. – Makoto Jul 4 '13 at 16:31
did you try dmesg? – Angs Jul 4 '13 at 16:37
I'm pretty sure the kernel doesn't (by default) log information about mounted filesystems anywhere. Adding a 'printk' to the appropriate system call to dump its parameters and the current time would seem to be the best approach. – Jules Jul 4 '13 at 16:40

AFAIK, the information you're looking for is not retained by default. I would suggest the easiest way is probably to modify the mount command to add the information to a log file somewhere, although this leaves open the possibility that another program is using the relevant system calls directly rather than running mount. The alternative, admittedly better, would be to modify the kernel to do it. Assuming you're running Linux, the change would be relatively simple, but all kernel changes, even simple ones, have a tendency to take some time to get working properly.

share|improve this answer
My problem is that I am running Unix and I am not totally sure I can modify the mount command. – user2551168 Jul 4 '13 at 17:02
As an alternative, I was looking at the /var/log/syslog, although it is quite messy... – user2551168 Jul 4 '13 at 17:03
"Unix" is a rather vague specification, as the name is commonly used to refer to quite a few different systems. Which precise version of Unix are you running? – Jules Jul 4 '13 at 23:21
This is what I find with "uname -a" Darwin Lilianas-MacBook-Pro.local 12.4.0 Darwin Kernel Version 12.4.0: Wed May 1 17:57:12 PDT 2013; root:xnu-2050.24.15~1/RELEASE_X86_64 x86_64 – user2551168 Jul 5 '13 at 13:02
In that case, you should be able to acquire a copy of the source code for the xnu kernel from, add necessary logging in the mount system call (the 'log()' function adds items to the syslog log, which is probably what you want to do) and recompile the kernel. – Jules Jul 5 '13 at 13:11

As far as my knowledge, there is no such logging available which gives you the time stamp,except the dmesg but that will only give the status of a device which is either connected or disconnected.

Workaround could be, you can write a simple script for logging, in a while(1) loop which should contain date and mount command alongwith grep which only writes the selected data to logfile. Please remember, to put sleep for sufficient amount of time for next loop. Then you can run it as a background process.

share|improve this answer
What I did is to create a thread that periodically reads the system.log file and identifies the USB id and the mount directory respectively from the lines containing the string "USBMSC Identifier (non-unique):" and "log dir:". I also save the mounted devices and the directory where they are mounted in a hash table. In this way when a unmount event is raised I can identify the unmounted device by checking whether their corresponding mount directory still exists. I know this is not exactly the cleanest way but it works in many cases. Thank you for your help! – user2551168 Jul 5 '13 at 13:04

Not the answer you're looking for? Browse other questions tagged .