What’s the difference between udev and hald

They're different devices.

/dev/sda is the first disk that's either SCSI or (more likely) providing the SCSI drive API to user land. This includes SATA drives and IDE drives using libata. This can also be an IDE/SATA/SCSI/etc. drive emulated by the hypervisor.

/dev/vda is the first disk using the virtualization-aware disk driver. The performance should be much better, as the hypervisor doesn't have to emulate some hardware interface.

If the disk has been exposed to your VM under both interfaces, you should prefer /dev/vda as it'll almost certainly be faster.

The /sys filesystem (sysfs) contains files that provide information about devices: whether it's powered on, the vendor name and model, what bus the device is plugged into, etc. It's of interest to applications that manage devices.

The /dev filesystem contains files that allow programs to access the devices themselves: write data to a serial port, read a hard disk, etc. It's of interest to applications that access devices.

A metaphor is that /sys provides access to the packaging, while /dev provides access to the content of the box.

The files in /sys are not device nodes, but symbolic links and regular files. Those regular files are special in that reading or writing to them invokes file-specific functions in the kernel, like device nodes. The difference is that files in /sys work this way because of the filesystem they are on, whereas device nodes work this way due to their device node characteristics (the file type indicating a (block or character) device, and the device major and minor number indicating which device it is).

The reason for /dev existing independently of /sys is partly historical: /dev dates back to the dawn of Unix, while /sys is a much more recent invention. If Linux was designed today with no historical background, /dev/sda might be /sys/block/sda/content.