Strange results when I do a df
 

I was having issues where my Ubuntu system was not able to boot. I created a boot disk and went in and messed around. In the end, with the help of these forums, I am able to boot again and everthing seems back to normal except I get the following when I do a "df":

Filesystem Size Used Avail Use% Mounted on
varrun 252M 164K 252M 1% /var/run
varlock 252M 4.0K 252M 1% /var/lock
udev 252M 136K 252M 1% /dev
devshm 252M 0 252M 0% /dev/shm
lrm 252M 19M 234M 8% /lib/modules/2.6.15-27-386/volatile

This looks strange doesnt it? There is no hda3,hda1, etc... Anybody know what is going on here and if it's ok? Also, I have tons of photos on this server so this does not seem like an accurate disk usage. I am not really knowledgable on how the mounts or partitions should be setup.

Thanks for any help!

df only shows mounted partitions. It looks like when you executed this command, you had nothing of interest mounted.

Yeah, something should be mounted on /. Try running '/bin/df' directly, in case there are any aliases or anything with weird arguments. Also, what is the output of 'mount'?

Thanks for the replies.

/bin/df returns the exact same results.

mount returns:

proc on /proc type proc (rw)
/sys on /sys type sysfs (rw)
varrun on /var/run type tmpfs (rw)
varlock on /var/lock type tmpfs (rw)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
devshm on /dev/shm type tmpfs (rw)
lrm on /lib/modules/2.6.15-27-386/volatile type tmpfs (rw)

This make any sense?

Can you still see your files? Did you ever determine what caused your system to be unbootable the first time?

This is very odd... it's not showing ANY root filesystem.

Just curious…

What’s the output of “cat /proc/mounts”?

cat /proc/mounts results:

rootfs / rootfs rw 0 0
none /sys sysfs rw 0 0
none /proc proc rw,nodiratime 0 0
udev /dev tmpfs rw 0 0
/dev/hda1 / ext3 rw,data=ordered 0 0
/dev/hda1 /dev/.static/dev ext3 rw,data=ordered 0 0
tmpfs /var/run tmpfs rw 0 0
tmpfs /var/lock tmpfs rw 0 0
usbfs /proc/bus/usb usbfs rw 0 0
tmpfs /lib/modules/2.6.15-27-386/volatile tmpfs rw 0 0
devpts /dev/pts devpts rw 0 0
tmpfs /dev/shm tmpfs rw 0 0
tmpfs /var/run tmpfs rw 0 0
tmpfs /var/lock tmpfs rw 0 0

I'll try to find the thread of instructions I followed to get my system back to booting when it was having serious issues before. And all files are visible from what I can see. I have multiple app servers, web servers, and databases on this box and all are running perfectly.

Thanks

Very odd. Unfortunately, the only thing I could think of that would cause this is a rootkit or something. But why hide mountpoints? Very odd.

It doesn’t look like a rootkit to me (since the mountpoints are not hidden at the kernel level—i.e., they’re reported correctly by /proc/mounts). The cause seems to me to be incorrect permissions on /etc/mtab and family. Could you post the output of:

ls -l /etc/{m,blkid.}tab results:

ls: /etc/blkid.tab: No such file or directory
-rw-r--r-- 1 root root 294 2007-05-12 20:12 /etc/mtab

Hmm… These seem like fine permissions to me. Perhaps at the time of mounting, the permissions are not fine. Or perhaps your startup scripts (or whatever you use) are calling “mount -n” (which abstains from writing to /etc/mtab).

You might try a few diagnostics to see if the mount program itself will update /etc/mtab as it is supposed to do. Try the following with a few “dummy” filesystems (first with a tmpfs, then with a non-nodev filesystem): The command prompt has been left off for easy copy-and-pasting (in the hope that you will copy and paste the entire output to the forum):
(N.B., The command prompt has been left off for easy copy-and-pasting — in the hope that you will copy and paste the output to the forum)

As for solutions, there are a few. Obviously, the ideal solution is to find out why mtab is not being written to at system starup. I think that hand-editing /etc/mtab (adding the entries from /proc/mounts, but leaving out things like “rootfs / rootfs rw 0 0”) is very kludgey, but will last if umount doesn’t write to /etc/mtab at system shutdown. If this happens (i.e., your mtab has information properly removed by umount, yet not properly added by mount), I suggest symlinking /etc/mtab to /proc/mounts. Though symlinking will work, it is not ideal, since there is some information not stored in /proc/mounts (about how mount was called — especially with loopback devices).

P.S., I noticed the modification date on your /etc/mtab is quite behind. Do you shut off your machine at night, or has this computer been on since “2007-05-12 20:12”? If you do shut off your machine, this time gives us a clue as to when the last successful write to /etc/mtab occurred.

Thanks for the great reply! Sorry, I was out of town so haven't had an oppotunity to do any testing with this until today.

Yes, the last restart was on 5/12 so looks like the write to mtab was fine.

Here are the results of the execution:

I'm not very experienced in this so kind of lost on what you're looking for. But let me know your opinion please. Thanks again for the help!