I'm observing udevadm monitor to detect when the usb is un-mounted, or partition (USB) is removed.

if the partition /dev/sda1 is mounted at /mnt/mydisk

If I remove the partition /dev/sda1 via physically removing the USB stick. I see remove event appearing on udevadm monitor but if try to just umount the disk /mnt/mydisk.

umount /mnt/mydisk

No event of changes appear in udevadm monitor. Likewise the event for mount also does not show up on monitor

mount /dev/sda1 /mnt/mydisk

Is it even possible to get such changes event in udev.

I have no udev rule laid in /etc/udev/rules.d

By mounting you are not making any changes to your devices, you are merely starting to use the filesystem laid on it. Therefore it is not an event for udev.

Is there by any means possible to get a notification for such behaviour?

Why do you care ?. Who (what) will be issuing the [u]mount if it's not you ?.

What info do you require ?. Just the fact the command has been issued, the device node involved, the mount point ... ?. How disciplined are the mount-points - always the same, or unpredictable ?. If you are prepared to sit on udevadm, what about polling the mount command to see what has changed ?. Not event notification but might suffice.

inotify might be the best bet, but depends on at least some of the answers above.

Well for starters we are sure about the mount point.


It is required as the running script operates along with the mounted drive, and if for some reason the mounted point is removed, the script should halt.

Polling is an option but it's expensive once hence was vouching on Kernel event msg for a better result.
plus /proc/mount is somewhat unreliable since I have seen occurrences where the USB stick has been physically removed but the associated entry in proc still exists.

ionotify might be the best bet I tried this but its just work over umount I still need a way to know if the partition is mounted at a known path.

There is probably gazillion ways to do it, 'mount | grep mountpoint' is one.

I had a similar problem about a NFS disk that sometimes disappeared. A script wrote some files on it, and when unmounted, the files ended up in the /mnt/diskname folder. I could maybe check the mount points, events or something. But the fast and easy way was to just create a file on the disk. In the writing script, I just checked if that file exist, and if not, send an alert and write somewhere else.

I don't think inotify /proc/mounts will work. It's not a file, so you would have to read it again and again to compare.

Agreed but not evented like netlink . I know its not a big deal but having and evented is way better than polling the mountpoint.

Also I think the latest version of linux have few syscall that monitor this(version >5.10) so it an obvious concern to them. Which also make me believe for linux version less than 5.10 there exist no such feature.

If the system is mounted and then its umounted I confirm that Umount event are triggered. Using inotify