[opensuse] filesystem is read-only, but some files are still being written to?
I have a filesystem mounted on /var that suddenly went read-only early this morning. Surprisingly, syslog-ng is still able to write to /var/log/mail and /var/log/messages? This is an older system, openSUSE 11.3, I'm running fsck, but I'd like to understand how $SUBJ works. -- Per Jessen, Zürich (3.6°C) http://www.hostsuisse.com/ - virtual servers, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 2016-11-09 12:23, Per Jessen wrote:
I have a filesystem mounted on /var that suddenly went read-only early this morning. Surprisingly, syslog-ng is still able to write to /var/log/mail and /var/log/messages? This is an older system, openSUSE 11.3, I'm running fsck, but I'd like to understand how $SUBJ works.
What about the output of "mount"? -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)
On 11/09/2016 01:26 PM, Carlos E. R. wrote:
What about the output of "mount"?
- think similar happened when mounting device , which had already , unbeknown , been auto-mounted. ........ regards -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 2016-11-09 12:47, ellanios82 wrote:
On 11/09/2016 01:26 PM, Carlos E. R. wrote:
What about the output of "mount"?
- think similar happened when mounting device ,
which had already , unbeknown , been auto-mounted.
Yes, systemd can do that. But he is using 11.3, which maybe did not use systemd yet, or an initial version. I don't remember for sure. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)
Carlos E. R. wrote:
On 2016-11-09 12:47, ellanios82 wrote:
On 11/09/2016 01:26 PM, Carlos E. R. wrote:
What about the output of "mount"?
- think similar happened when mounting device ,
which had already , unbeknown , been auto-mounted.
Yes, systemd can do that. But he is using 11.3, which maybe did not use systemd yet, or an initial version. I don't remember for sure.
Uh, it's even openSUSE 11.0, no systemd here. Anyway, the filesystem was not mount or unmounted, it just went read-only (reason unknwn). -- Per Jessen, Zürich (5.7°C) http://www.dns24.ch/ - your free DNS host, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 2016-11-09 13:47, Per Jessen wrote:
Carlos E. R. wrote:
On 2016-11-09 12:47, ellanios82 wrote:
On 11/09/2016 01:26 PM, Carlos E. R. wrote:
What about the output of "mount"?
- think similar happened when mounting device ,
which had already , unbeknown , been auto-mounted.
Yes, systemd can do that. But he is using 11.3, which maybe did not use systemd yet, or an initial version. I don't remember for sure.
Uh, it's even openSUSE 11.0, no systemd here. Anyway, the filesystem was not mount or unmounted, it just went read-only (reason unknwn).
But the mount command contradicts, it says it is "rw". The explanation that it just keeps open files already open is possible, but strange in this case. If it is ro, it is ro for everything... it may not be able to close the file on end. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)
Dne středa 9. listopadu 2016 13:47:27 CET, Per Jessen napsal(a):
Carlos E. R. wrote:
On 2016-11-09 12:47, ellanios82 wrote:
On 11/09/2016 01:26 PM, Carlos E. R. wrote: Uh, it's even openSUSE 11.0, no systemd here. Anyway, the filesystem was not mount or unmounted, it just went read-only (reason unknwn).
HW problem? What about checking it with smartctl -t long? -- Vojtěch Zeisek Komunita openSUSE GNU/Linuxu Community of the openSUSE GNU/Linux https://www.opensuse.org/ https://trapa.cz/
Vojtěch Zeisek wrote:
Dne středa 9. listopadu 2016 13:47:27 CET, Per Jessen napsal(a):
Carlos E. R. wrote:
On 2016-11-09 12:47, ellanios82 wrote:
On 11/09/2016 01:26 PM, Carlos E. R. wrote: Uh, it's even openSUSE 11.0, no systemd here. Anyway, the filesystem was not mount or unmounted, it just went read-only (reason unknwn).
HW problem? What about checking it with smartctl -t long?
Oh, I expect it's a hardware problem, almost certainly. It's a RAID6 drive with three partitions, but only one partition went read-only. (I believe the RAID controller does the selftest on every drive regularly). -- Per Jessen, Zürich (5.6°C) http://www.dns24.ch/ - your free DNS host, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
Carlos E. R. wrote:
On 2016-11-09 12:23, Per Jessen wrote:
I have a filesystem mounted on /var that suddenly went read-only early this morning. Surprisingly, syslog-ng is still able to write to /var/log/mail and /var/log/messages? This is an older system, openSUSE 11.3, I'm running fsck, but I'd like to understand how $SUBJ works.
What about the output of "mount"?
The relevant line is: /dev/cciss/c0d1p1 on /var type jfs (rw) -- Per Jessen, Zürich (5.6°C) http://www.dns24.ch/ - free dynamic DNS, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 2016-11-09 13:25, Per Jessen wrote:
Carlos E. R. wrote:
On 2016-11-09 12:23, Per Jessen wrote:
I have a filesystem mounted on /var that suddenly went read-only early this morning. Surprisingly, syslog-ng is still able to write to /var/log/mail and /var/log/messages? This is an older system, openSUSE 11.3, I'm running fsck, but I'd like to understand how $SUBJ works.
What about the output of "mount"?
The relevant line is:
/dev/cciss/c0d1p1 on /var type jfs (rw)
Well, it is mounted read write, which is what I thought it would say. How that happened, no idea. I'm assuming that it reflects the current state of the mount... -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)
Carlos E. R. wrote:
On 2016-11-09 13:25, Per Jessen wrote:
Carlos E. R. wrote:
On 2016-11-09 12:23, Per Jessen wrote:
I have a filesystem mounted on /var that suddenly went read-only early this morning. Surprisingly, syslog-ng is still able to write to /var/log/mail and /var/log/messages? This is an older system, openSUSE 11.3, I'm running fsck, but I'd like to understand how $SUBJ works.
What about the output of "mount"?
The relevant line is:
/dev/cciss/c0d1p1 on /var type jfs (rw)
Well, it is mounted read write, which is what I thought it would say. How that happened, no idea.
I'm assuming that it reflects the current state of the mount...
I'm not sure that is what 'mount' shows - in particular since /var is currently read-only. I suspect 'mount' just shows the content of /etc/mtab (or something like that). -- Per Jessen, Zürich (5.8°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 11/09/2016 06:23 AM, Per Jessen wrote:
I have a filesystem mounted on /var that suddenly went read-only early this morning. Surprisingly, syslog-ng is still able to write to /var/log/mail and /var/log/messages? This is an older system, openSUSE 11.3, I'm running fsck, but I'd like to understand how $SUBJ works.
Here is a possible explanation. I emphasise POSSIBLE! *NIX file semantics are such that if a file handle is being held open by a process then that file remains in existence in terms of the open inode and allocated space even if the file is logically 'deleted', that is its name entry is unlinked from the directory. It occurs to me that perhaps the syslog=ng process had the files /var/log/messages and /varlog/mail (and possible others) open in write mode when the event that cause the FS to go into logical read-only mode occurred. That being so, the condition held those files open in write mode. Possible? -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
Anton Aylward wrote:
On 11/09/2016 06:23 AM, Per Jessen wrote:
I have a filesystem mounted on /var that suddenly went read-only early this morning. Surprisingly, syslog-ng is still able to write to /var/log/mail and /var/log/messages? This is an older system, openSUSE 11.3, I'm running fsck, but I'd like to understand how $SUBJ works.
Here is a possible explanation. I emphasise POSSIBLE!
*NIX file semantics are such that if a file handle is being held open by a process then that file remains in existence in terms of the open inode and allocated space even if the file is logically 'deleted', that is its name entry is unlinked from the directory.
It occurs to me that perhaps the syslog=ng process had the files /var/log/messages and /varlog/mail (and possible others) open in write mode when the event that cause the FS to go into logical read-only mode occurred. That being so, the condition held those files open in write mode.
Possible?
I think yes. Looking at a directory listing, /var/log/mail and /var/log/messages have not been modified since 0137 this morning, but looking that the files with 'less', lines are being written all the time. -- Per Jessen, Zürich (5.8°C) http://www.hostsuisse.com/ - dedicated server rental in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
participants (5)
-
Anton Aylward -
Carlos E. R. -
ellanios82 -
Per Jessen -
Vojtěch Zeisek