source: udev/README.Logging @ 4d1a13a

How to watch udev activity when booting
#######################################


1) Make syslog start before udev:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Since udev writes all output to syslog, we need service syslog running before
udevd starts. There are two ways to achieve this.

Either add the needed link to /etc/init.d/earlysyslog in /etc/init.d/boot.d/ manually. But it must start later then boot.rootfsck.

Or you edit the service scripts itself and let insserv create the links. You
have to change earlysyslog and boot.udev:
  /etc/init.d/earlysyslog
    Add 'B' to 'Default-Start:' and 'boot.rootfsck' to 'Required-Start:'
    # Required-Start: boot.rootfsck
    # Default-Start:  B 2 3 5
  /etc/init.d/boot.udev
    Add 'earlysyslog' to 'Required-Start'
    # Required-Start:    boot.rootfsck earlysyslog
Then call
  /sbin/insserv -d earlysyslog
Check if earlysyslog comes before boot.udev in /etc/init.d/boot.d/S*

You need /var on your root partition for that because boot.localfs is started
after udev. If you have a seperate /var partition, make it available somehow or
change the location of your syslog file.


2) Enable logging
^^^^^^^^^^^^^^^^^
set udev_log=info in /etc/udev/udev.conf. 

There is also debug, but you are very
probably not interested in the huge amount of debugging output from udev. It
writes about 70M logfile at a single boot.

Many tools which are called from hotplug also respect the setting of udev_log.
But there might be some which need special actions to make them verbose.
[to be enhanced: list tools and their individual debug switches]

You may change udevs loglevel at runtime with
  udevcontrol log_priority=<level>


3) Reboot
^^^^^^^^^
For further processing of the logging output you should get a clean logfile at
next boot. Just move the old logfile away. Syslog will still use the moved file
until shutdown (until syslog restarted).
mv /var/log/messages /var/log/messages.`date +%s`

Then reboot.


4) Getting logged events sorted
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
There is a script 'show_event_log' which may be used to extract info out of
/var/log/messages. Call it
  show_event_log <first> [<last> [<list of event types>] ]
<first> is the sequence number of the first event you are interested in.
<last>  is the number of the last event. You may write 'last' literally. It may
        also be omitted if you want to see a single event. 
<list>  is a list of event types you like to see. If you omit it, you get most
        events, not all. Some are exclude by default. Use " " as list if you
        want to see really all. Or edit the list of skipped events in the first
        lines of the script
If you don't use /var/log/messages as lockfile you may set the environment
variable MESSAGES=<logfile>.

The script is slowly. It is just a quick hack. The larger the syslog file the
slower the script. Therefore always boot with a fresh logfile.
Improvements are welcome.


Have a lot of fun, as always ;)