And to answer your question, about what could cause such a burst of events, this time I have an easy answer: mdevd-coldplug !
Yes, I forgot to mention this. The kernel-generated events seem to be significantly heavier than the mdev-style synthetic ones. The DEVPATH is the full path without symlinks, which is usually pretty long, and there are also a bunch of misc variables with every event. It's very common for a kernel- generated event to reach 250 bytes, which means a 64kB buffer can only hold 256 events, and probably less because some events are easily 300 bytes long; so I tripled the buffer size. If it's not enough for a run-of-the-mill desktop PC, I should increase it again. 1 MB sounds really excessive though: it means it would be able to hold 3000 to 4000 events. Can you run mdevd-coldplug with a dry-run mdevd to count the number of events, you're getting and their approximate size? A nice trick to trace events is to add the following line at the top of your mdev.conf file: -.* 0:0 0600 ! @env which will send a bunch of lines to your catch-all logger. :) Thanks for testing! -- Laurent