LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 05-22-2007, 09:27 AM   #1
mlh
LQ Newbie
 
Registered: May 2007
Posts: 5

Rep: Reputation: 0
Strange results when I do a df


I was having issues where my Ubuntu system was not able to boot. I created a boot disk and went in and messed around. In the end, with the help of these forums, I am able to boot again and everthing seems back to normal except I get the following when I do a "df":

Filesystem Size Used Avail Use% Mounted on
varrun 252M 164K 252M 1% /var/run
varlock 252M 4.0K 252M 1% /var/lock
udev 252M 136K 252M 1% /dev
devshm 252M 0 252M 0% /dev/shm
lrm 252M 19M 234M 8% /lib/modules/2.6.15-27-386/volatile

This looks strange doesnt it? There is no hda3,hda1, etc... Anybody know what is going on here and if it's ok? Also, I have tons of photos on this server so this does not seem like an accurate disk usage. I am not really knowledgable on how the mounts or partitions should be setup.

Thanks for any help!
 
Old 05-22-2007, 07:45 PM   #2
osor
HCL Maintainer
 
Registered: Jan 2006
Distribution: (H)LFS, Gentoo
Posts: 2,450

Rep: Reputation: 70
df only shows mounted partitions. It looks like when you executed this command, you had nothing of interest mounted.
 
Old 05-22-2007, 08:12 PM   #3
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
Yeah, something should be mounted on /. Try running '/bin/df' directly, in case there are any aliases or anything with weird arguments. Also, what is the output of 'mount'?
 
Old 05-23-2007, 10:50 AM   #4
mlh
LQ Newbie
 
Registered: May 2007
Posts: 5

Original Poster
Rep: Reputation: 0
Thanks for the replies.

/bin/df returns the exact same results.

mount returns:

proc on /proc type proc (rw)
/sys on /sys type sysfs (rw)
varrun on /var/run type tmpfs (rw)
varlock on /var/lock type tmpfs (rw)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
devshm on /dev/shm type tmpfs (rw)
lrm on /lib/modules/2.6.15-27-386/volatile type tmpfs (rw)

This make any sense?
 
Old 05-23-2007, 12:38 PM   #5
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
Can you still see your files? Did you ever determine what caused your system to be unbootable the first time?

This is very odd... it's not showing ANY root filesystem.
 
Old 05-23-2007, 02:29 PM   #6
osor
HCL Maintainer
 
Registered: Jan 2006
Distribution: (H)LFS, Gentoo
Posts: 2,450

Rep: Reputation: 70
Just curious…

What’s the output of “cat /proc/mounts”?
 
Old 05-23-2007, 03:39 PM   #7
mlh
LQ Newbie
 
Registered: May 2007
Posts: 5

Original Poster
Rep: Reputation: 0
cat /proc/mounts results:

rootfs / rootfs rw 0 0
none /sys sysfs rw 0 0
none /proc proc rw,nodiratime 0 0
udev /dev tmpfs rw 0 0
/dev/hda1 / ext3 rw,data=ordered 0 0
/dev/hda1 /dev/.static/dev ext3 rw,data=ordered 0 0
tmpfs /var/run tmpfs rw 0 0
tmpfs /var/lock tmpfs rw 0 0
usbfs /proc/bus/usb usbfs rw 0 0
tmpfs /lib/modules/2.6.15-27-386/volatile tmpfs rw 0 0
devpts /dev/pts devpts rw 0 0
tmpfs /dev/shm tmpfs rw 0 0
tmpfs /var/run tmpfs rw 0 0
tmpfs /var/lock tmpfs rw 0 0

I'll try to find the thread of instructions I followed to get my system back to booting when it was having serious issues before. And all files are visible from what I can see. I have multiple app servers, web servers, and databases on this box and all are running perfectly.

Thanks
 
Old 05-23-2007, 03:50 PM   #8
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
Very odd. Unfortunately, the only thing I could think of that would cause this is a rootkit or something. But why hide mountpoints? Very odd.
 
Old 05-23-2007, 04:30 PM   #9
osor
HCL Maintainer
 
Registered: Jan 2006
Distribution: (H)LFS, Gentoo
Posts: 2,450

Rep: Reputation: 70
Quote:
Originally Posted by Matir
Unfortunately, the only thing I could think of that would cause this is a rootkit or something.
It doesn’t look like a rootkit to me (since the mountpoints are not hidden at the kernel level—i.e., they’re reported correctly by /proc/mounts). The cause seems to me to be incorrect permissions on /etc/mtab and family. Could you post the output of:
Code:
$ ls -l /etc/{m,blkid.}tab
 
Old 05-24-2007, 08:54 AM   #10
mlh
LQ Newbie
 
Registered: May 2007
Posts: 5

Original Poster
Rep: Reputation: 0
ls -l /etc/{m,blkid.}tab results:

ls: /etc/blkid.tab: No such file or directory
-rw-r--r-- 1 root root 294 2007-05-12 20:12 /etc/mtab
 
Old 05-24-2007, 01:04 PM   #11
osor
HCL Maintainer
 
Registered: Jan 2006
Distribution: (H)LFS, Gentoo
Posts: 2,450

Rep: Reputation: 70
Hmm… These seem like fine permissions to me. Perhaps at the time of mounting, the permissions are not fine. Or perhaps your startup scripts (or whatever you use) are calling “mount -n” (which abstains from writing to /etc/mtab).

You might try a few diagnostics to see if the mount program itself will update /etc/mtab as it is supposed to do. Try the following with a few “dummy” filesystems (first with a tmpfs, then with a non-nodev filesystem): The command prompt has been left off for easy copy-and-pasting (in the hope that you will copy and paste the entire output to the forum):
Code:
sudo bash
cp /etc/mtab /etc/mtab.original
mkdir /my_new_tmpfs
mount -t tmpfs none /my_new_tmpfs
mount
diff -u /etc/mtab{.original,}
cd /my_new_tmpfs
mkdir my_new_mountpoint
dd if=/dev/zero of=my_image.img count=2048
mke2fs -F my_image.img
mount -o loop my_image.img my_new_mountpoint
mount
diff -u /etc/mtab{.original,}
umount my_new_mountpoint
cd /
umount my_new_tmpfs
rm -r my_new_tmpfs /etc/mtab.original
exit
(N.B., The command prompt has been left off for easy copy-and-pasting — in the hope that you will copy and paste the output to the forum)

As for solutions, there are a few. Obviously, the ideal solution is to find out why mtab is not being written to at system starup. I think that hand-editing /etc/mtab (adding the entries from /proc/mounts, but leaving out things like “rootfs / rootfs rw 0 0”) is very kludgey, but will last if umount doesn’t write to /etc/mtab at system shutdown. If this happens (i.e., your mtab has information properly removed by umount, yet not properly added by mount), I suggest symlinking /etc/mtab to /proc/mounts. Though symlinking will work, it is not ideal, since there is some information not stored in /proc/mounts (about how mount was called — especially with loopback devices).

P.S., I noticed the modification date on your /etc/mtab is quite behind. Do you shut off your machine at night, or has this computer been on since “2007-05-12 20:12”? If you do shut off your machine, this time gives us a clue as to when the last successful write to /etc/mtab occurred.
 
Old 05-31-2007, 10:49 AM   #12
mlh
LQ Newbie
 
Registered: May 2007
Posts: 5

Original Poster
Rep: Reputation: 0
Thanks for the great reply! Sorry, I was out of town so haven't had an oppotunity to do any testing with this until today.

Yes, the last restart was on 5/12 so looks like the write to mtab was fine.

Here are the results of the execution:

Code:
sudo bash
cp /etc/mtab /etc/mtab.original
mkdir /my_new_tmpfs
mount -t tmpfs none /my_new_tmpfs
mount
root@asiago:~# cp /etc/mtab /etc/mtab.original
cd /my_new_tmpfs
root@asiago:~# mkdir /my_new_tmpfs
mkdir my_new_mountpoint
dd if=/dev/zero of=my_image.img count=2048
mke2fs -F my_image.img
mount -o loop my_image.img my_new_mountpoint
mount
diff -u /etc/mtab{.original,}
umount my_new_mountpoint
cd /
root@asiago:~# mount -t tmpfs none /my_new_tmpfs
umount my_new_tmpfs
root@asiago:~# mount
rm -r my_new_tmpfs /etc/mtab.original
exitproc on /proc type proc (rw)
/sys on /sys type sysfs (rw)
varrun on /var/run type tmpfs (rw)
varlock on /var/lock type tmpfs (rw)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
devshm on /dev/shm type tmpfs (rw)
lrm on /lib/modules/2.6.15-27-386/volatile type tmpfs (rw)
none on /my_new_tmpfs type tmpfs (rw)
root@asiago:~# diff -u /etc/mtab{.original,}
--- /etc/mtab.original  2007-05-31 10:35:29.000000000 -0500
+++ /etc/mtab   2007-05-31 10:35:29.000000000 -0500
@@ -7,3 +7,4 @@
 devpts /dev/pts devpts rw,gid=5,mode=620 0 0
 devshm /dev/shm tmpfs rw 0 0
 lrm /lib/modules/2.6.15-27-386/volatile tmpfs rw 0 0
+none /my_new_tmpfs tmpfs rw 0 0
root@asiago:~# cd /my_new_tmpfs
root@asiago:/my_new_tmpfs# mkdir my_new_mountpoint
root@asiago:/my_new_tmpfs# dd if=/dev/zero of=my_image.img count=2048
2048+0 records in
2048+0 records out
1048576 bytes (1.0 MB) copied, 0.005251 seconds, 200 MB/s
root@asiago:/my_new_tmpfs# mke2fs -F my_image.img
mke2fs 1.38 (30-Jun-2005)
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
128 inodes, 1024 blocks
51 blocks (4.98%) reserved for the super user
First data block=1
1 block group
8192 blocks per group, 8192 fragments per group
128 inodes per group

Writing inode tables: done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 24 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
root@asiago:/my_new_tmpfs# mount -o loop my_image.img my_new_mountpoint
root@asiago:/my_new_tmpfs# mount
proc on /proc type proc (rw)
/sys on /sys type sysfs (rw)
varrun on /var/run type tmpfs (rw)
varlock on /var/lock type tmpfs (rw)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
devshm on /dev/shm type tmpfs (rw)
lrm on /lib/modules/2.6.15-27-386/volatile type tmpfs (rw)
none on /my_new_tmpfs type tmpfs (rw)
/my_new_tmpfs/my_image.img on /my_new_tmpfs/my_new_mountpoint type ext2 (rw,loop=/dev/loop0)
root@asiago:/my_new_tmpfs# diff -u /etc/mtab{.original,}
--- /etc/mtab.original  2007-05-31 10:35:29.000000000 -0500
+++ /etc/mtab   2007-05-31 10:35:29.000000000 -0500
@@ -7,3 +7,5 @@
 devpts /dev/pts devpts rw,gid=5,mode=620 0 0
 devshm /dev/shm tmpfs rw 0 0
 lrm /lib/modules/2.6.15-27-386/volatile tmpfs rw 0 0
+none /my_new_tmpfs tmpfs rw 0 0
+/my_new_tmpfs/my_image.img /my_new_tmpfs/my_new_mountpoint ext2 rw,loop=/dev/loop0 0 0
root@asiago:/my_new_tmpfs# umount my_new_mountpoint
root@asiago:/my_new_tmpfs# cd /
root@asiago:/# umount my_new_tmpfs
root@asiago:/# rm -r my_new_tmpfs /etc/mtab.original
root@asiago:/# exit
exit
I'm not very experienced in this so kind of lost on what you're looking for. But let me know your opinion please. Thanks again for the help!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
APT-GET Results = Strange carlosinfl Debian 2 06-17-2006 02:45 AM
Strange installation results of Snort serverpimp Debian 3 11-01-2005 04:41 PM
upgraded to LE 2005... strange results supe2dresq Mandriva 5 06-15-2005 07:16 AM
Strange results from dmesg JimBass Linux - Newbie 11 03-27-2005 06:15 PM
Strange port scan results sbogus Linux - Security 16 06-29-2004 02:25 AM


All times are GMT -5. The time now is 03:44 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration