Hi everyone.

I need an opinion on a file system issue I experienced using Ubuntu Feisty.

Been running Feisty as the main family desktop for almost a year and it's been mostly plain sailing.

I have noticed that on boot up, it forces a file system check every 38 boots. This takes ages but has always completed without issue and the system comes up fine.

A few days ago though, the file system check exited with error code 4, dropped me into a shell with instructions to run fsck manually. I did this and developed some apprehension at what I saw:

* Thousands of issues were found and I was asked to 'clear' or 'repair' indoes? etc.. I held down the 'y' key for 10-20secs to answer yes to these questions.

* Then hundreds screen fulls of numbers scrolled up my screen. At this point I thought my machine was in a melt down.

* But then it asked to 'clear' or 'repair' more inodes, to which I answered yes again.

Eventually fsck exited and I rebooted to Feisty with no issues.
Having backed up my data, I've been using the machine for several days and have not noticed any problems.

My questions:

Why were there so many errors on my drive?

Is this indicative of a fault with the drive?

Should I replace the drive?

Should I be concerned?

Should I use tunefs to force a check more often?

During install, I opted for the default partition scheme.
Should I have partitioned the drive differently?


Thanks for any comments,
karl

Hardware:
AMDx2 Dual Core 4800+
200GB Sata Seagate Drive
3GB RAM
Mobo ASUS M2N-MX

the errors from on drive may be from improperly shutting down your computer. Things such as in pulling the plug or suddenly forcing to computer to power down. but on my computer, i do occasionaly get fsck messages like yours that are fixed after running fsck once.

You can change the number of boots between file system checks with the tune2fs command. You can even turn checking off entirely if you want. See:

man tune2fs

You can use the fsck -y option to turn off the questions and do everything automatically. See:

man fsck

Another thing to do is to check lost+found. When fsck finds files or directories which are orphans (i.e. fsck does not know what they are named or where they belong in the file tree) it gives the file or directory a number for a name and places it in the directory called lost+found. Each partition has its own lost+found directory. Whenever you run fsck on a partition and it finds errors you should check lost+found for orphans.

-----------------------
Steve Stites

So how serious a problem is this?
Should I replace my drive?

Never had such issues when I was a windows user.

The problem is trivial and you should not replace your drive.

--------------------------
Steve Stites

Thanks for the feedback.

Actually, I have lost many files, some of which I have ended up in the lost+found directory.
I'm thinking this is bad. I've never ever lost files to corruption.

Do you know how I can check the drive for hardware fault?

Could you post a typical name for a file you found in lost+found? Also how many files are in lost+found? Are any of the files in lost+found arranged in a partial tree?

You can check your drive for hardware faults using badblocks. Read the man page for badblocks carefully before you try to use it. See:

man badblocks

----------------------------
Steve Stites

Hi Steve,
lost+found contains 457 items totaling 1.2gb.

100% of the files there are from my mp3 colelction, names like nomad.mp3, one drop east.mp3 etc..... Some of the files have mutated with other files and are no longer mp3s. Example, "Blood Suagr Sex Magik" appears as an executable file in lost+found. Another appears as a txt doc. All the files are in folders called #24756632 etc with only the last 3 digits changing.

All the files in there have been lost from my mp3 collection. They all seem to be bands starting with "r" or "s". Like REM, Red Hot Chillis .... There are some remnants in the original location. Like the folder REM is now an executable.
I don't recall amarok crashing recently... but even if it did, i should not lose data!

I forced an fsck -y on the next reboot and a few errors were found, with files I'd restored from lost+found. The whole check was quite quick, but I had to run it manually after being dropped into a shell.

Something has failed somewhere, either in software or hardware.
I just need to know where so I can fix it.

Thanks for your comments.

Unix file systems have a lot of redundency in the file tree structure. If you had a bad spot on the disk then the filesystem drivers and/or fsck would figure out which copy of the redundant information was bad and replace it with a good copy. Having enough copies of the redundent information to be bad to where the file system software or fsck cannot repair it is indicative of a system crash. The system probably crashed and the cache was not written out to the file system. There was enough file system information changed in the cache but not yet written to disk that portions of the file system stucture were lost in more than one location on the hard drive. Thus fsck finds a directory and some of its files which fsck cannot figure out where they belong so it drops them into lost+found.

The original crash could be caused by a power failure, ram or cpu hardware errors which cause the kernel to crash, etc. It is unlikely to be caused by intermittent disk errors. It could be caused by a solid disk failure but then you wouldn't be able to repair it with fsck. The original crash could also be caused by software errors which cause the kernel to lock up.

In any case you are not going to be able to trace back from fragments found in lost+found to the original error. You need further clues such as a kernel panic, cpu failure, etc. to find out what problem caused the cache to not be written out.

-------------------------------
Steve Stites

Thanks Steve,

I kinda follow what you are saying. Hope you don't mind me asking, but the cache that failed to be written to disk: could that result in loss of files that have been on the disk for sometime and were not being edited at the time of the crash?

What do you think of the fact that the files lost were in folders starting with letter "R" and "S"? Any significance there?

I'll try and check logs to find out what may have caused the crash.
Do you have any tips on what I should look for?

I will be running fsck -y every 3 boots. Should I replace the drive if I continue to experience errors?

Cheers again.

fsck finding file system errors is not conclusive evidence of drive problems.

Yes. How that can happen is you might be making some changes to the directory structure and lose pointers to part of the directory tree which includes files which are not being currently updated. In your lost+found orphans fsck did not know what a particular directory was or where it belonged. It gave that directory a number name and put it in lost+found. fsck also found some files which it knew the name of and that they belonged to the unknown directory. So the information that was lost in a crash of some sort pertained to the directory but not the files that directory contained. Probably the directory inode was being updated in some way at the time of the crash but the files were not.

----------------------
Steve Stites

Yet what if this occurs even without any recent crashes?

Data loss is unforgivable of any computer system, particularly an OS.
I have previously been a Windows user and have been much more brutal with Windows. Cold reboots galore. Lockups, blue screens (even in XP)... etc.
Never ever lost data.

I have not had to do very many cold reboots on Ubuntu. I only experienced crashes when I enabled "Desktop Effects". Never done so again.

All my hardware is brand new. I built the system from scratch in a g4 case.

I love linux and have 'played' with it since RH6.
But I am left wondering if my recent data loss experience is more related to the OS rather the very few crashes I have experienced with it.

Is ext3 really better than NTFS or fat32?
Could this be a linux issue *perish the thought*?

Thanks for your comments Steve, they have been very educational, but I am still at a bit of a loss (pun not intended) what to do.