Anton Aylward wrote:
On 11/09/2016 06:23 AM, Per Jessen wrote:
I have a filesystem mounted on /var that suddenly went read-only early this morning. Surprisingly, syslog-ng is still able to write to /var/log/mail and /var/log/messages? This is an older system, openSUSE 11.3, I'm running fsck, but I'd like to understand how $SUBJ works.
Here is a possible explanation. I emphasise POSSIBLE!
*NIX file semantics are such that if a file handle is being held open by a process then that file remains in existence in terms of the open inode and allocated space even if the file is logically 'deleted', that is its name entry is unlinked from the directory.
It occurs to me that perhaps the syslog=ng process had the files /var/log/messages and /varlog/mail (and possible others) open in write mode when the event that cause the FS to go into logical read-only mode occurred. That being so, the condition held those files open in write mode.
Possible?
I think yes. Looking at a directory listing, /var/log/mail and /var/log/messages have not been modified since 0137 this morning, but looking that the files with 'less', lines are being written all the time. -- Per Jessen, Zürich (5.8°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org