[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ale] mounted filesystem becomes read-only



Check out the command lsattr. You can make a FS ro with it even though
mount will show it rw.
Also, is that disk on a san? I'm seeing this happen randomly with our
dell san connected via iscsi to the vmware server.

--Dennis



On Fri, Jun 11, 2010 at 8:31 AM, Greg Freemyer <greg.freemyer at gmail.com> wrote:
> sometimes if the kernel sees fs corruption it will internally set a fs
> to readonly.
>
> check your kernel logs
>
> On Fri, Jun 11, 2010 at 8:12 AM, Geoffrey <lists at serioustechnology.com> wrote:
>> I don't get this. ?I have a mounted file system that I just created a vm
>> on via vmware player. ?It's never been unmounted, yet if I try to create
>> a file on it I get:
>>
>> touch foo
>> touch: cannot touch `foo': Read-only file system
>>
>> More weirdness:
>>
>> root at mac/media/vmware> mount|grep vmware
>> /dev/sdb3 on /media/vmware type ext3 (rw)
>>
>> The OS clearly thinks it's a writable file system.
>>
>> Clues anyone?????
>>
>> I can't unmount it either as it says it's busy, and I'm pretty sure that
>> has something to do with vmware:
>>
>> ps aux|grep vmware
>> root ? ? ?2837 ?0.0 ?0.0 ?18552 ? 884 ? ? ? ? ?Ss ? Jun09 ? 0:00
>> /usr/bin/vmware-usbarbitrator
>> root ? ? ?2926 ?0.0 ?0.0 ?10980 ? 156 ? ? ? ? ?Ss ? Jun09 ? 0:00
>> /usr/bin/vmnet-dhcpd -s 6 -cf /etc/vmware/vmnet1/dhcpd/dhcpd.conf -lf
>> /etc/vmware/vmnet1/dhcpd/dhcpd.leases -pf
>> /var/run/vmnet-dhcpd-vmnet1.pid vmnet1
>> root ? ? ?2949 ?0.0 ?0.0 ?10980 ? 540 ? ? ? ? ?Ss ? Jun09 ? 0:00
>> /usr/bin/vmnet-dhcpd -s 6 -cf /etc/vmware/vmnet8/dhcpd/dhcpd.conf -lf
>> /etc/vmware/vmnet8/dhcpd/dhcpd.leases -pf
>> /var/run/vmnet-dhcpd-vmnet8.pid vmnet8
>> root ? ? ?2955 ?0.0 ?0.0 ? 9116 ? 964 ? ? ? ? ?S ? ?Jun09 ? 0:37
>> /usr/bin/vmnet-natd -s 6 -m /etc/vmware/vmnet8/nat.mac -c
>> /etc/vmware/vmnet8/nat/nat.conf
>> esoteric 14124 ?0.0 ?0.0 ? 2852 ? 780 ? ? ? ? ?S< ? Jun10 ? 0:00
>> /usr/lib/vmware/bin/thnuclnt -pdir /tmp/vmware-esoteric/thnuclnt-14114 -fg
>> esoteric 14126 ?0.0 ?0.0 ?11304 ? 980 ? ? ? ? ?S< ? Jun10 ? 0:00
>> /usr/lib/vmware/bin/thnuclnt -pdir /tmp/vmware-esoteric/thnuclnt-14114 -fg
>> esoteric 14128 ?0.0 ?0.0 ?57468 ? 248 ? ? ? ? ?S< ? Jun10 ? 0:00
>> /usr/lib/vmware/bin/thnuclnt -pdir /tmp/vmware-esoteric/thnuclnt-14114 -fg
>> esoteric 14129 ?0.0 ?0.0 ?57472 ? 224 ? ? ? ? ?S< ? Jun10 ? 0:00
>> /usr/lib/vmware/bin/thnuclnt -pdir /tmp/vmware-esoteric/thnuclnt-14114 -fg
>>
>>
>> --
>> Until later, Geoffrey
>>
>> "I predict future happiness for America if they can prevent
>> the government from wasting the labors of the people under
>> the pretense of taking care of them."
>> - Thomas Jefferson
>> _______________________________________________
>> Ale mailing list
>> Ale at ale.org
>> http://mail.ale.org/mailman/listinfo/ale
>> See JOBS, ANNOUNCE and SCHOOLS lists at
>> http://mail.ale.org/mailman/listinfo
>>
>
>
>
> --
> Greg Freemyer
> Head of EDD Tape Extraction and Processing team
> Litigation Triage Solutions Specialist
> http://www.linkedin.com/in/gregfreemyer
> CNN/TruTV Aired Forensic Imaging Demo -
> ? http://insession.blogs.cnn.com/2010/03/23/how-computer-evidence-gets-retrieved/
>
> The Norcross Group
> The Intersection of Evidence & Technology
> http://www.norcrossgroup.com
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>