USB monitoring on RasPiOS

The first place I'd look is in syslog (/var/log/syslog), then maybe dmesg but that may have no more than syslog.

On Tue, 3 May 2022 18:00:26 -0000 (UTC), bob prohaska snipped-for-privacy@www.zefox.net>

declaimed the following:

Closest seems to be

pi@rpi3bplus-1:~$ apt show usbtop Package: usbtop Version: 0.2-1 Priority: optional Section: misc Maintainer: Dmitry Smirnov snipped-for-privacy@debian.org Installed-Size: 102 kB Depends: libboost-atomic1.62.0, libboost-chrono1.62.0, libboost-date-time1.62.0, libboost-system1.62.0, libboost-thread1.62.0, libc6 (>= 2.15), libgcc1 (>= 1:3.5), libpcap0.8 (>= 0.9.8), libstdc++6 (>=

pi@rpi3bplus-1:~$

USB access, errors etc. get logged in /var/log/messages so you can see all the gory detail of USB activity by running something like:

sudo tail -f /var/log/messages | grep "USB"

which can be very useful for debugging. However, If I wanted 24 hour monitoring of selected USB activity, I'd install the logwatch package and write a logwatch reporting module to capture exactly the detail I want to see. For instance I did that to report activations of the UPS that supports my house server and internet gateway. This setup by default sends daily reports to root on my house server, which is configured to forward logwatch reports to my usual login on a laptop. Logwatch modules are traditionally Perl scripts but I don't think there's anything preventing you from using awk or any other compiled or scripting language instead.

USB equivalents of Wireshark, the TCP/IP message analyser/scanner, may also exist: I haven't needed them so haven't looked.

Last time I looked (admittedly some years ago), Wireshark itself did USB captures. The decoding was rather rudimentary, though.

So Wireshark is the first place I'd look. If it runs on RasPiOS, of course.

David

Much to my surprise there was nothing in syslog and very little by way of dmesg | grep -i usb, all of it device discovery during boot. I guess that means USB works without problems......

Thanks for writing!

bob prohaska

Monitor as in actively, or the current state? If the latter, then lsusb. See man lsusb after installing (not sure if it already is in the Lite or Full distro). Try:

lsusb lsusb -tvv (tree view can have 0, 1 or 2 v's but doesn't need sudo) sudo lsusb -vs 2:2 (first external usb3 device)

On Tue, 03 May 2022 22:49:36 +0100, David Higton snipped-for-privacy@davehigton.me.uk>

declaimed the following:

md_admin@microdiversity:~$ apt search wireshark Sorting... Done Full Text Search... Done

libndpi-wireshark/oldstable 2.6-3 armhf extensible deep packet inspection library - wireshark dissector

libvirt-wireshark/oldstable 5.0.0-4+deb10u1 armhf Wireshark dissector for the libvirt protocol

libwireshark-data/oldstable 2.6.20-0+deb10u3 all network packet dissection library -- data files

libwireshark-dev/oldstable 2.6.20-0+deb10u3 armhf network packet dissection library -- development files

libwireshark11/oldstable 2.6.20-0+deb10u3 armhf network packet dissection library -- shared library

wireshark/oldstable 2.6.20-0+deb10u3 armhf network traffic analyzer - meta-package

wireshark-common/oldstable 2.6.20-0+deb10u3 armhf network traffic analyzer - common files

wireshark-dev/oldstable 2.6.20-0+deb10u3 armhf network traffic analyzer - development tools

wireshark-doc/oldstable 2.6.20-0+deb10u3 all network traffic analyzer - documentation

wireshark-gtk/oldstable 2.6.20-0+deb10u3 armhf network traffic analyzer - GTK+ version

wireshark-qt/oldstable 2.6.20-0+deb10u3 armhf network traffic analyzer - Qt version

Looks like a viable combination... Including a choice of GUI <G>

Restrspectively, as in how many errors (and on which device) since boot. Bonus points for what kind of errors.

Looks like it's already installed. But, lsusb seems to report what devices are present. I don't see an option for seeing errors.

Thanks for writing!

bob prohaska

Have you seen and/or captured any USB errors so far? If so, note which logfile they are written to (probably /var/log/messages since that is where connect/disconnect USB messages go on my (Fedora, not Pi) systems, and keep a copy of at least one.

Then write a logwatch report script that reports matching messages. I'd try an awk script for starters ('sed & awk' is a very well written O'Reilly book and awk is a scripting language that was designed for quickly producing custom reports from file content), but you may prefer to use Perl or Python.

Never on RasPiOS. I'd like to use it as a point of comparison.

Perhaps it's a wild goose chase.....

Thanks for writing!

bob prohaska

Enable usbmon in the kernel. Google is your friend.