Hello everyone! Still something wrong, what I have missed? After some struggling, I have simply checked last modification time of every files in the /var directory, and filtered the files which are changed in a one-two day interval. I have boot a RIP kernel through PXE and move every directory and files to destination /mnt/var, which changes are not need. Make a gzipped tarball of /mnt/var, clean it up, left only an empty directory /mnt/var. On boot I mount a tmpfs on /mnt/var and extract the tarball to /mnt/var (actually a tmpfs). After complete boot I have /proc/mounts as these:
rootfs / rootfs rw 0 0 none /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0 none /proc proc rw,nosuid,nodev,noexec,relatime 0 0 none /dev devtmpfs rw,relatime,size=1017196k,nr_inodes=254299,mode=755 0 0 none /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 /dev/disk/by-label/Rendszer / ext2 rw,noatime,errors=remount-ro 0 0 tmpfs /mnt/var tmpfs rw,relatime 0 0 tmpfs /lib/init/rw tmpfs rw,nosuid,relatime,mode=755 0 0 none /var aufs rw,relatime,si=1a502864c7c1c06b 0 0 tmpfs /dev/shm tmpfs rw,nosuid,nodev,relatime 0 0 tmpfs /tmp tmpfs rw,relatime 0 0 But something wrong :( At first I'm trying to edit my user's crontab, which exist only in /var/spool/cron/crontabs/"me" and does not exist on /mnt/var. After reboot my edits was lost :( Same with /var/lib/alsa/asound.state - also exist only on USB. What is wrong? Any ideas? Any help? Sincerely tovis ------------------------------------------------------------------------------ All the data continuously generated in your IT infrastructure contains a definitive record of customers, application performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. And common sense. http://p.sf.net/sfu/splunk-novd2d
