Re: Averiguar qué proceso está escribiendo a disco [SOLUCIONADO]
El Miércoles, 12 de Septiembre de 2007, Iñaki Baz Castillo escribió:
> El Martes, 11 de Septiembre de 2007, Iñigo Tejedor Arrondo escribió:
> > echo -n "1" >/proc/sys/vm/block_dump
>
> Hola de nuevo. Ahora mismo ha ocurrido (ocurre), multitud de escrituras.
> He seguido tus indicaciones y esto es lo que, de forma repetida, me sale en
> el syslog:
>
> Sep 12 23:05:05 portatil kernel: [13628.804000] kjournald(2460): WRITE
> block 11147056 on hdc1 Sep 12 23:05:05 portatil kernel: [13628.804000]
> kjournald(2460): WRITE block 11137944 on hdc1 Sep 12 23:05:05 portatil
> kernel: [13628.804000] kjournald(2460): WRITE block 11150040 on hdc1 Sep 12
> 23:05:05 portatil kernel: [13628.804000] kjournald(2460): WRITE block
> 11150048 on hdc1 Sep 12 23:05:05 portatil kernel: [13628.804000]
> kjournald(2460): WRITE block 186432 on hdc1 Sep 12 23:05:05 portatil
> kernel: [13628.804000] kjournald(2460): WRITE block 186440 on hdc1 Sep 12
> 23:05:05 portatil kernel: [13628.804000] kjournald(2460): WRITE block
> 186448 on hdc1 Sep 12 23:05:05 portatil kernel: [13628.804000]
> kjournald(2460): WRITE block 186456 on hdc1 Sep 12 23:05:05 portatil
> kernel: [13628.804000] kjournald(2460): WRITE block 186464 on hdc1 Sep 12
> 23:05:05 portatil kernel: [13628.804000] kjournald(2460): WRITE block
> 186472 on hdc1 Sep 12 23:05:05 portatil kernel: [13628.804000]
> kjournald(2460): WRITE block 186480 on hdc1 Sep 12 23:05:05 portatil
> kernel: [13628.804000] kjournald(2460): WRITE block 186488 on hdc1 Sep 12
> 23:05:05 portatil kernel: [13628.804000] kjournald(2460): WRITE block
> 186496 on hdc1
>
> Y de vez en cuando:
>
> Sep 12 23:05:17 portatil kernel: [13641.124000] pidof(20629): dirtied inode
> 2858859 (exe) on proc Sep 12 23:05:17 portatil kernel: [13641.124000]
> pidof(20629): dirtied inode 2858862 (exe) on proc Sep 12 23:05:17 portatil
> kernel: [13641.124000] pidof(20629): dirtied inode 2858865 (exe) on proc
> Sep 12 23:05:17 portatil kernel: [13641.184000] bash(5690): dirtied inode
> 4026531950 (block_dump) on proc Sep 12 23:05:18 portatil kernel:
> [13628.804000] syslogd(4860): dirtied inode 634209 (auth.log) on hdc1 Sep
> 12 23:05:18 portatil kernel: [13628.804000] syslogd(4860): dirtied inode
> 634209 (auth.log) on hdc1 Sep 12 23:05:18 portatil kernel: [13628.804000]
> syslogd(4860): WRITE block 11111968 on hdc1
>
>
> Esto tiene pinta de fallo de disco, ¿verdad?
No, no es eso.
Gracias a este link he encontrado el problema:
http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg92336.html
Ocurre, y esto es lo que tengo que investigar a fondo, que mi auth.log está
todo loco:
Sep 12 23:22:01 portatil su[19068]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19068]: (pam_unix) session closed for user ibc
Sep 12 23:22:01 portatil su[19092]: Successful su for ibc by root
Sep 12 23:22:01 portatil su[19092]: + ??? root:ibc
Sep 12 23:22:01 portatil su[19092]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19092]: (pam_unix) session closed for user ibc
Sep 12 23:22:01 portatil su[19116]: Successful su for ibc by root
Sep 12 23:22:01 portatil su[19116]: + ??? root:ibc
Sep 12 23:22:01 portatil su[19116]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19116]: (pam_unix) session closed for user ibc
Sep 12 23:22:01 portatil su[19140]: Successful su for ibc by root
Sep 12 23:22:01 portatil su[19140]: + ??? root:ibc
Sep 12 23:22:01 portatil su[19140]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19140]: (pam_unix) session closed for user ibc
Sep 12 23:22:01 portatil su[19164]: Successful su for ibc by root
Sep 12 23:22:01 portatil su[19164]: + ??? root:ibc
Sep 12 23:22:01 portatil su[19164]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19164]: (pam_unix) session closed for user ibc
Sep 12 23:22:01 portatil su[19188]: Successful su for ibc by root
Sep 12 23:22:01 portatil su[19188]: + ??? root:ibc
Sep 12 23:22:01 portatil su[19188]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19188]: (pam_unix) session closed for user ibc
Así todo el rato sin parar. Y resulta que en syslog.conf estaba dicho fichero
sin un - delante, luego se sincroniza el fichero inemdiatamente tras cada
lectura.
Ha sido poner un - al auth.log y corregirse el acceso de escritura. Ahora el
problema es averiguar porqué mi auth.log está loco.
Muchas gracias sobre todo a Iñigo.
--
Iñaki Baz Castillo
Reply to: