Loading...

VONDS ©

Lab 113: sysfs Exploration

Back to Lab Index

Use sysfs to map devices to drivers and read live device attributes from /sys. Cross-check sysfs evidence with standard tooling like lsblk before you make hardware-impacting changes.

hardware troubleshooting rhcsa

Scenario

You are diagnosing a system where device identification and driver binding matters. You will use sysfs to answer questions like “what devices exist,” “what vendor/model is a disk reporting,” and “which kernel driver is bound,” then confirm those facts with user-space tools.

Operator context

sysfs is the kernel’s live view of devices, drivers, and attributes. Treat it as evidence, then cross-check with tools like lsblk so your conclusions hold up in tickets and incident notes.

Objective

  • Explore the top-level layout of /sys.
  • Find network interfaces under /sys/class/net.
  • Identify block devices under /sys/block.
  • Read disk attributes (size, vendor, model) from sysfs.
  • Resolve driver bindings using sysfs symlinks.
  • Verify device major and minor numbers via uevent and lsblk.
  • Resolve a NIC driver binding from /sys/class/net.

Concepts

  • sysfs (/sys) exposes live kernel objects: devices, drivers, buses, and attributes.
  • sysfs paths often include symlinks that represent kernel relationships (device → driver, class → device).
  • Many values in sysfs are raw kernel units (for example, disk size in 512-byte sectors).
  • uevent data bridges sysfs objects to device nodes via major and minor numbers.
  • Cross-checking sysfs with user-space tools reduces mistakes before storage or network changes.

Walkthrough

Step 1 : List the first 10 entries at the top of /sys.
Command 
ls -l /sys | head -n 10

This gives you the major entry points: devices, classes, buses, modules, and kernel-level namespaces. 

total 0
dr-xr-xr-x  10 root root 0 Aug 19 12:00 block
dr-xr-xr-x  59 root root 0 Aug 19 12:00 bus
dr-xr-xr-x  52 root root 0 Aug 19 12:00 class
dr-xr-xr-x   4 root root 0 Aug 19 12:00 dev
dr-xr-xr-x  10 root root 0 Aug 19 12:00 devices
dr-xr-xr-x   5 root root 0 Aug 19 12:00 firmware
dr-xr-xr-x   3 root root 0 Aug 19 12:00 fs
dr-xr-xr-x   2 root root 0 Aug 19 12:00 kernel
dr-xr-xr-x  17 root root 0 Aug 19 12:00 module
Step 2 : List entries in the network class under /sys/class/net.
Command 
ls -1 /sys/class/net

Network interfaces are exposed as class devices. The entries here map directly to interface names. 

eth0
lo
Step 3 : List block devices exposed by sysfs.
Command 
ls -l /sys/block

Each block device is represented as a symlink to the real kernel device path under /sys/devices. 

total 0
lrwxrwxrwx 1 root root 0 Aug 19 12:00 sda -> ../devices/pci0000:00/.../block/sda
lrwxrwxrwx 1 root root 0 Aug 19 12:00 sr0 -> ../devices/pci0000:00/.../block/sr0
Step 4 : Print the size (in 512-byte sectors) of /sys/block/sda.
Command 
cat /sys/block/sda/size

This value is in sectors, not bytes. Multiply by 512 when you need size math for capacity checks. 

83886080
Step 5 : Show the storage device vendor and model for sda.
Command 
cat /sys/block/sda/device/vendor
Command 
cat /sys/block/sda/device/model

Vendor and model are useful for inventory validation and for confirming you are operating on the correct device before making storage changes. 

ATA
Generic_Disk
Step 6 : Resolve the absolute path of the driver bound to sda’s device.
Command 
readlink -f /sys/block/sda/device/driver

Driver binding answers “what is actually handling this device” at the kernel level. This is often the fastest way to confirm which driver stack you are on. 

/sys/bus/scsi/drivers/sd
Step 7 : Print uevent properties for sda.
Command 
cat /sys/block/sda/uevent

The uevent file provides key identifiers like major and minor numbers. This is how you match a sysfs object to a device node. 

MAJOR=8
MINOR=0
DEVNAME=sda
DEVTYPE=disk
Step 8 : Cross-check sda’s major and minor using lsblk.
Command 
lsblk -o NAME,MAJ:MIN | grep '^sda'

This confirms user-space tooling agrees with what sysfs reports. 

sda  8:0
Step 9 : Resolve the driver bound to eth0 via sysfs.
Command 
readlink -f /sys/class/net/eth0/device/driver

This is the NIC equivalent of the disk driver binding check. It is useful when debugging driver modules, virtual NICs, and performance issues. 

/sys/bus/pci/drivers/e1000

Common breakpoints

/sys paths do not match your host layout

Device names vary by platform (for example, sda may be vda or nvme0n1). Use ls -l /sys/block to identify the correct target, then substitute the device name in the remaining commands.

vendor/model files are empty or missing

Some virtual devices do not populate vendor/model fields. Treat sysfs as “what the kernel exposes,” then cross-check identity with lsblk and your hypervisor or cloud metadata.

readlink returns no driver binding

If the driver symlink is missing, you may be looking at the wrong path or a device class that does not expose a driver link the same way. Confirm the device exists under /sys/devices via the symlink in /sys/block or /sys/class.

lsblk output does not match uevent MAJOR/MINOR

Ensure you are matching the correct device (disk versus partition) and that your grep filter targets the right line. If needed, run lsblk without filtering and compare again.

Cleanup checklist

This lab is read-only. Your cleanup is capturing the sysfs evidence (device identity, driver binding, and major/minor) and confirming it matches what user-space tools report.

Commands 
ls -l /sys | head -n 10
ls -1 /sys/class/net
ls -l /sys/block
cat /sys/block/sda/size
cat /sys/block/sda/device/vendor
cat /sys/block/sda/device/model
readlink -f /sys/block/sda/device/driver
cat /sys/block/sda/uevent
lsblk -o NAME,MAJ:MIN | grep '^sda'
readlink -f /sys/class/net/eth0/device/driver
Success signal

You can name the device, show its reported attributes, and prove which driver is bound using sysfs, with lsblk confirming the same major/minor mapping.

Reference

  • ls -l /sys : Shows the high-level sysfs layout.
    • /sys : Kernel-exported device and driver view (devices, classes, buses, modules).
  • ls -1 /sys/class/net : Lists network interfaces exposed as class devices.
    • /sys/class/net : Network interface class directory.
  • ls -l /sys/block : Lists block devices as symlinks to their kernel device paths.
    • /sys/block : Block device namespace.
  • cat /sys/block/<dev>/size : Prints device size in 512-byte sectors.
    • /sys/block/<dev>/size : Sector count for the device.
  • cat /sys/block/<dev>/device/vendor : Prints the device vendor string (when provided).
  • cat /sys/block/<dev>/device/model : Prints the device model string (when provided).
  • readlink -f /sys/block/<dev>/device/driver : Resolves the bound kernel driver path for a device.
    • -f : Follows symlinks and prints the absolute path.
  • cat /sys/block/<dev>/uevent : Shows uevent properties including major and minor numbers.
    • MAJOR and MINOR : Device numbers used to create the corresponding node.
  • lsblk -o NAME,MAJ:MIN : Cross-checks major and minor mappings in user space.
    • -o : Selects output columns.
  • lsblk -o NAME,MAJ:MIN | grep '^<dev>' : Filters lsblk output to a specific device.
    • | : Pipes output from the left command into the right command.
    • grep '^<dev>' : Matches the device name at the start of the line.