Scan Linux SCSI Generic Devices with sg_scan

You will finish with a repeatable way to list the Linux SCSI generic devices currently visible to sg_scan, ask each device for SCSI INQUIRY data, and investigate the most common permission and device-name mistakes. Allow about ten minutes. You need the sg3-utils package and access to a host with SCSI, SAS, USB storage, an optical drive, or another device exposing an sg node.

The installed package here is sg3-utils 1.46-3ubuntu4. The local manual page is older, labelled sg3_utils-1.36 and dated May 2013. The installed executable reports 4.17 20180219 with -V and has a few help details absent from that manual page. The examples below use options present in both the local manual and the executable.

1. Confirm the executable and version

Start with read-only checks. They do not need elevated privileges:

$ command -v sg_scan
/usr/bin/sg_scan
$ sg_scan -V
Version string: 4.17 20180219
$ dpkg-query -W -f='${Package} ${Version}\n' sg3-utils
sg3-utils 1.46-3ubuntu4

Do not treat the package version, the manual-page label, and the program's own version string as interchangeable. If they disagree on another host, read that host's manual page and help output before scripting around an option.

2. Run the default numeric scan

With no device argument, sg_scan scans sg devices and prints a line for each sg device currently bound to a SCSI device. The default naming style is numeric, such as /dev/sg0 and /dev/sg1:

$ sg_scan
sg_scan: Error opening /dev/sg0 : Permission denied
sg_scan: Error opening /dev/sg1 : Permission denied

Your output may instead contain device mappings. On this machine the nodes exist but are owned by root:disk, so a user outside the disk group sees permission errors. The command can still return status 0 in this situation, so read the diagnostics rather than using the exit status as proof that every device was inspected.

Check the nodes and your group membership without changing anything:

$ ls -l /dev/sg*
$ id
$ printf 'scan status: %s\n' "$?"

The last line only reports id, not sg_scan. Capture a command's status immediately if a script needs it:

$ sg_scan; scan_status=$?; printf 'sg_scan status: %s\n' "$scan_status"

3. Repeat the scan with explicit numeric naming

-n selects numeric scanning and is already the default. It is useful when a script should state that choice clearly:

$ sg_scan -n
sg_scan: Error opening /dev/sg0 : Permission denied
sg_scan: Error opening /dev/sg1 : Permission denied

The scanner uses the normal Linux sg naming convention and, on modern kernels, consults sysfs to find active nodes. Numbering can therefore have holes after hardware is removed. A missing /dev/sg2 does not by itself mean that scanning stopped at /dev/sg1.

4. Use alphabetical names only for legacy compatibility

-a asks for alphabetical names such as sga, sgb, and sgc. The manual marks these nodes as deprecated since the Linux 2.2 kernel series:

$ sg_scan -a

Use this only when an old script or device naming scheme explicitly requires it. For new work, keep the numeric default and record the actual /dev/sgN path shown by the scan.

5. Ask for identification data

Add -i to perform a SCSI INQUIRY and print the result on an indented second line. This is often the quickest way to distinguish a disk enclosure, tape device, optical drive, or other target:

$ sg_scan -i
  /dev/sg0  ...
    ... INQUIRY information ...

The exact device line and identification text depend on the hardware, so do not compare the spacing or vendor string byte for byte in a test. If the target is an ATA disk, the manual says the command tries an ATA IDENTIFY operation and reports that information instead.

You can restrict the check to a named device. Use a real path from your host, not this placeholder:

$ sg_scan -i /dev/sg0

Passing an ordinary file or unrelated character device is not a harmless substitute for an sg device. For example, /dev/null is rejected because it does not support the required SCSI or ATA ioctl. That test does not discover hardware and should not be used as a health check.

6. Understand access and write-mode options

The scanner opens devices non-blocking so an exclusive lock held by another process should not make the scan hang. Its normal open mode is read-only. -w requests a read/write open:

$ sg_scan -w -i /dev/sg0

A read/write open is an access request, not an instruction to write media. It can still fail where a read-only open would work, and it may require membership in the device's group or an elevated shell. Try the ordinary read-only command first. If your operational policy permits elevated access, run only the diagnostic command with sudo:

$ sudo sg_scan -i /dev/sg0

Do not add sudo to a script merely to hide permission errors. Fix the host's device-access policy after checking its security requirements, and do not add users to the disk group casually. No example in this guide changes device contents, service state, or persistent configuration, so there is no rollback operation.

7. Add queueing information only when diagnosing it

-x adds extra information about queueing. It is useful when you are comparing device behaviour or investigating how requests are handled, but it is not needed for an ordinary inventory:

$ sg_scan -x -i /dev/sg0

Use lsscsi when you need a broader view of SCSI topology and sysfs-derived information. The sg_scan(8) manual specifically points to it for Linux 2.6 and 3 series kernels and notes that it normally does not need root permissions. Treat it as a complementary inventory tool, not as a replacement for checking whether a particular sg node can be opened.