LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - General (http://www.linuxquestions.org/questions/linux-general-1/)
-   -   Strange results when I do a df (http://www.linuxquestions.org/questions/linux-general-1/strange-results-when-i-do-a-df-555798/)

mlh 05-22-2007 09:27 AM

Strange results when I do a df
 
I was having issues where my Ubuntu system was not able to boot. I created a boot disk and went in and messed around. In the end, with the help of these forums, I am able to boot again and everthing seems back to normal except I get the following when I do a "df":

Filesystem Size Used Avail Use% Mounted on
varrun 252M 164K 252M 1% /var/run
varlock 252M 4.0K 252M 1% /var/lock
udev 252M 136K 252M 1% /dev
devshm 252M 0 252M 0% /dev/shm
lrm 252M 19M 234M 8% /lib/modules/2.6.15-27-386/volatile

This looks strange doesnt it? There is no hda3,hda1, etc... Anybody know what is going on here and if it's ok? Also, I have tons of photos on this server so this does not seem like an accurate disk usage. I am not really knowledgable on how the mounts or partitions should be setup.

Thanks for any help!

osor 05-22-2007 07:45 PM

df only shows mounted partitions. It looks like when you executed this command, you had nothing of interest mounted.

Matir 05-22-2007 08:12 PM

Yeah, something should be mounted on /. Try running '/bin/df' directly, in case there are any aliases or anything with weird arguments. Also, what is the output of 'mount'?

mlh 05-23-2007 10:50 AM

Thanks for the replies.

/bin/df returns the exact same results.

mount returns:

proc on /proc type proc (rw)
/sys on /sys type sysfs (rw)
varrun on /var/run type tmpfs (rw)
varlock on /var/lock type tmpfs (rw)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
devshm on /dev/shm type tmpfs (rw)
lrm on /lib/modules/2.6.15-27-386/volatile type tmpfs (rw)

This make any sense?

Matir 05-23-2007 12:38 PM

Can you still see your files? Did you ever determine what caused your system to be unbootable the first time?

This is very odd... it's not showing ANY root filesystem.

osor 05-23-2007 02:29 PM

Just curious…

What’s the output of “cat /proc/mounts”?

mlh 05-23-2007 03:39 PM

cat /proc/mounts results:

rootfs / rootfs rw 0 0
none /sys sysfs rw 0 0
none /proc proc rw,nodiratime 0 0
udev /dev tmpfs rw 0 0
/dev/hda1 / ext3 rw,data=ordered 0 0
/dev/hda1 /dev/.static/dev ext3 rw,data=ordered 0 0
tmpfs /var/run tmpfs rw 0 0
tmpfs /var/lock tmpfs rw 0 0
usbfs /proc/bus/usb usbfs rw 0 0
tmpfs /lib/modules/2.6.15-27-386/volatile tmpfs rw 0 0
devpts /dev/pts devpts rw 0 0
tmpfs /dev/shm tmpfs rw 0 0
tmpfs /var/run tmpfs rw 0 0
tmpfs /var/lock tmpfs rw 0 0

I'll try to find the thread of instructions I followed to get my system back to booting when it was having serious issues before. And all files are visible from what I can see. I have multiple app servers, web servers, and databases on this box and all are running perfectly.

Thanks

Matir 05-23-2007 03:50 PM

Very odd. Unfortunately, the only thing I could think of that would cause this is a rootkit or something. But why hide mountpoints? Very odd.

osor 05-23-2007 04:30 PM

Quote:

Originally Posted by Matir
Unfortunately, the only thing I could think of that would cause this is a rootkit or something.

It doesn’t look like a rootkit to me (since the mountpoints are not hidden at the kernel level—i.e., they’re reported correctly by /proc/mounts). The cause seems to me to be incorrect permissions on /etc/mtab and family. Could you post the output of:
Code:

$ ls -l /etc/{m,blkid.}tab

mlh 05-24-2007 08:54 AM

ls -l /etc/{m,blkid.}tab results:

ls: /etc/blkid.tab: No such file or directory
-rw-r--r-- 1 root root 294 2007-05-12 20:12 /etc/mtab

osor 05-24-2007 01:04 PM

Hmm… These seem like fine permissions to me. Perhaps at the time of mounting, the permissions are not fine. Or perhaps your startup scripts (or whatever you use) are calling “mount -n” (which abstains from writing to /etc/mtab).

You might try a few diagnostics to see if the mount program itself will update /etc/mtab as it is supposed to do. Try the following with a few “dummy” filesystems (first with a tmpfs, then with a non-nodev filesystem): The command prompt has been left off for easy copy-and-pasting (in the hope that you will copy and paste the entire output to the forum):
Code:

sudo bash
cp /etc/mtab /etc/mtab.original
mkdir /my_new_tmpfs
mount -t tmpfs none /my_new_tmpfs
mount
diff -u /etc/mtab{.original,}
cd /my_new_tmpfs
mkdir my_new_mountpoint
dd if=/dev/zero of=my_image.img count=2048
mke2fs -F my_image.img
mount -o loop my_image.img my_new_mountpoint
mount
diff -u /etc/mtab{.original,}
umount my_new_mountpoint
cd /
umount my_new_tmpfs
rm -r my_new_tmpfs /etc/mtab.original
exit

(N.B., The command prompt has been left off for easy copy-and-pasting — in the hope that you will copy and paste the output to the forum)

As for solutions, there are a few. Obviously, the ideal solution is to find out why mtab is not being written to at system starup. I think that hand-editing /etc/mtab (adding the entries from /proc/mounts, but leaving out things like “rootfs / rootfs rw 0 0”) is very kludgey, but will last if umount doesn’t write to /etc/mtab at system shutdown. If this happens (i.e., your mtab has information properly removed by umount, yet not properly added by mount), I suggest symlinking /etc/mtab to /proc/mounts. Though symlinking will work, it is not ideal, since there is some information not stored in /proc/mounts (about how mount was called — especially with loopback devices).

P.S., I noticed the modification date on your /etc/mtab is quite behind. Do you shut off your machine at night, or has this computer been on since “2007-05-12 20:12”? If you do shut off your machine, this time gives us a clue as to when the last successful write to /etc/mtab occurred.

mlh 05-31-2007 10:49 AM

Thanks for the great reply! Sorry, I was out of town so haven't had an oppotunity to do any testing with this until today.

Yes, the last restart was on 5/12 so looks like the write to mtab was fine.

Here are the results of the execution:

Code:

sudo bash
cp /etc/mtab /etc/mtab.original
mkdir /my_new_tmpfs
mount -t tmpfs none /my_new_tmpfs
mount
root@asiago:~# cp /etc/mtab /etc/mtab.original
cd /my_new_tmpfs
root@asiago:~# mkdir /my_new_tmpfs
mkdir my_new_mountpoint
dd if=/dev/zero of=my_image.img count=2048
mke2fs -F my_image.img
mount -o loop my_image.img my_new_mountpoint
mount
diff -u /etc/mtab{.original,}
umount my_new_mountpoint
cd /
root@asiago:~# mount -t tmpfs none /my_new_tmpfs
umount my_new_tmpfs
root@asiago:~# mount
rm -r my_new_tmpfs /etc/mtab.original
exitproc on /proc type proc (rw)
/sys on /sys type sysfs (rw)
varrun on /var/run type tmpfs (rw)
varlock on /var/lock type tmpfs (rw)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
devshm on /dev/shm type tmpfs (rw)
lrm on /lib/modules/2.6.15-27-386/volatile type tmpfs (rw)
none on /my_new_tmpfs type tmpfs (rw)
root@asiago:~# diff -u /etc/mtab{.original,}
--- /etc/mtab.original  2007-05-31 10:35:29.000000000 -0500
+++ /etc/mtab  2007-05-31 10:35:29.000000000 -0500
@@ -7,3 +7,4 @@
 devpts /dev/pts devpts rw,gid=5,mode=620 0 0
 devshm /dev/shm tmpfs rw 0 0
 lrm /lib/modules/2.6.15-27-386/volatile tmpfs rw 0 0
+none /my_new_tmpfs tmpfs rw 0 0
root@asiago:~# cd /my_new_tmpfs
root@asiago:/my_new_tmpfs# mkdir my_new_mountpoint
root@asiago:/my_new_tmpfs# dd if=/dev/zero of=my_image.img count=2048
2048+0 records in
2048+0 records out
1048576 bytes (1.0 MB) copied, 0.005251 seconds, 200 MB/s
root@asiago:/my_new_tmpfs# mke2fs -F my_image.img
mke2fs 1.38 (30-Jun-2005)
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
128 inodes, 1024 blocks
51 blocks (4.98%) reserved for the super user
First data block=1
1 block group
8192 blocks per group, 8192 fragments per group
128 inodes per group

Writing inode tables: done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 24 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
root@asiago:/my_new_tmpfs# mount -o loop my_image.img my_new_mountpoint
root@asiago:/my_new_tmpfs# mount
proc on /proc type proc (rw)
/sys on /sys type sysfs (rw)
varrun on /var/run type tmpfs (rw)
varlock on /var/lock type tmpfs (rw)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
devshm on /dev/shm type tmpfs (rw)
lrm on /lib/modules/2.6.15-27-386/volatile type tmpfs (rw)
none on /my_new_tmpfs type tmpfs (rw)
/my_new_tmpfs/my_image.img on /my_new_tmpfs/my_new_mountpoint type ext2 (rw,loop=/dev/loop0)
root@asiago:/my_new_tmpfs# diff -u /etc/mtab{.original,}
--- /etc/mtab.original  2007-05-31 10:35:29.000000000 -0500
+++ /etc/mtab  2007-05-31 10:35:29.000000000 -0500
@@ -7,3 +7,5 @@
 devpts /dev/pts devpts rw,gid=5,mode=620 0 0
 devshm /dev/shm tmpfs rw 0 0
 lrm /lib/modules/2.6.15-27-386/volatile tmpfs rw 0 0
+none /my_new_tmpfs tmpfs rw 0 0
+/my_new_tmpfs/my_image.img /my_new_tmpfs/my_new_mountpoint ext2 rw,loop=/dev/loop0 0 0
root@asiago:/my_new_tmpfs# umount my_new_mountpoint
root@asiago:/my_new_tmpfs# cd /
root@asiago:/# umount my_new_tmpfs
root@asiago:/# rm -r my_new_tmpfs /etc/mtab.original
root@asiago:/# exit
exit

I'm not very experienced in this so kind of lost on what you're looking for. But let me know your opinion please. Thanks again for the help!


All times are GMT -5. The time now is 03:45 AM.