lsmod

What it does

How to write it

lsmod

$ run as a normal user# run as root (or with sudo)

1. 1All loaded modules

   $lsmod | head
   Module                  Size  Used by
   xfs                  2654208  2
   libcrc32c              12288  2 xfs,nf_tables

   Used by: count and module names.

2. 2Is a module loaded?

   $lsmod | grep -w vfat

   No output = not loaded.

3. 3Network card driver

   $lsmod | grep -E 'virtio_net|e1000|ixgbe|mlx'

   Which NIC driver runs.

4. 4Count modules

   $lsmod | tail -n +2 | wc -l

   Number of loaded modules.

5. 5Modules with users

   $lsmod | awk '$3 > 0'

   These cannot be removed at once.

6. 6Same data from /proc

   $cat /proc/modules | head -3

   lsmod reads this file.

7. 7Biggest modules

   $lsmod | sort -k2 -n -r | head -5

   Memory use of drivers.

8. 8Check a blocked module stays off (security)

   $lsmod | grep usb_storage || echo "usb-storage not loaded"

   Verify your blacklist.

9. 9Find unusual modules (security)

   $lsmod | awk 'NR>1 {print $1}' | while read m; do modinfo -F filename $m >/dev/null 2>&1 || echo "no file: $m"; done

   A loaded module without a file on disk can be a rootkit.

10. 10Module details

    $modinfo $(lsmod | awk 'NR==2 {print $1}')

    Info for the first module in the list.

Nothing matches this filter.

Files

/proc/modules

The kernel list of loaded modules.

Exit codes