root fs will be automatically remounted read-only if a filesystem error is encountered that is uncorrectable. This is done to protect against any further data corruption and usually means you've got a dying drive. You probably won't see the actual error in the logs as the system wouldn't have been able to write to the log after remounting the filesystem read-only. When it occurs, you will probably see a lot of errors on the console - like ATA timeout errors, journal aborted, etc.
You should run offline fsck as soon as possible to be sure. For the root filesystem this is best done using a rescue disk (such as sysrescuecd). Your fixed HD will usually be /dev/sda if booting from sysrescuecd.
This can usually be accomplished also by passing init=/bin/bash at the boot prompt to skip system startup scripts and go straight to shell prompt. The root filesystem may or may not be mounted read-only, but with no active services running, you can run "mount -o remount,ro /" before "fsck -f /" to be sure the filesystem is actually mounted read-only. You DO NOT want to run fsck on an active (read-write) filesystem!
You'll want to check /var/log/messages for any warnings about your drive(s) that may have been written before the critical error occurred. Also install smartmon utils and run smartctl -a /dev/<your_root_fs_device> and check Reallocated_Sector_Ct and Current_Pending_Sector. Reallocated_Sector_Ct means bad sectors have been found on the disk and have been migrated to spare sectors on the disk. Current_Pending_Sector means bad sectors have been found but have not been migrated to spare sectors. Both should ideally be zero, but Current_Pending_Sector is a bigger problem than Reallocated_Sector_Ct (maybe no more spare sectors available).
If you have no pending or reallocated sectors, you probably have a bad data cable or the cables connected to the drive aren't making good contact and just need to be reseated.
|