El Miércoles, 12 de Septiembre de 2007, Iñaki Baz Castillo escribió:
El Martes, 11 de Septiembre de 2007, Iñigo Tejedor Arrondo escribió:
echo -n 1 /proc/sys/vm/block_dump
Hola de nuevo. Ahora mismo ha ocurrido (ocurre), multitud de escrituras.
He seguido tus indicaciones y esto es lo que, de forma repetida, me sale en
el syslog:
Sep 12 23:05:05 portatil kernel: [13628.804000] kjournald(2460): WRITE
block 11147056 on hdc1 Sep 12 23:05:05 portatil kernel: [13628.804000]
kjournald(2460): WRITE block 11137944 on hdc1 Sep 12 23:05:05 portatil
kernel: [13628.804000] kjournald(2460): WRITE block 11150040 on hdc1 Sep 12
23:05:05 portatil kernel: [13628.804000] kjournald(2460): WRITE block
11150048 on hdc1 Sep 12 23:05:05 portatil kernel: [13628.804000]
kjournald(2460): WRITE block 186432 on hdc1 Sep 12 23:05:05 portatil
kernel: [13628.804000] kjournald(2460): WRITE block 186440 on hdc1 Sep 12
23:05:05 portatil kernel: [13628.804000] kjournald(2460): WRITE block
186448 on hdc1 Sep 12 23:05:05 portatil kernel: [13628.804000]
kjournald(2460): WRITE block 186456 on hdc1 Sep 12 23:05:05 portatil
kernel: [13628.804000] kjournald(2460): WRITE block 186464 on hdc1 Sep 12
23:05:05 portatil kernel: [13628.804000] kjournald(2460): WRITE block
186472 on hdc1 Sep 12 23:05:05 portatil kernel: [13628.804000]
kjournald(2460): WRITE block 186480 on hdc1 Sep 12 23:05:05 portatil
kernel: [13628.804000] kjournald(2460): WRITE block 186488 on hdc1 Sep 12
23:05:05 portatil kernel: [13628.804000] kjournald(2460): WRITE block
186496 on hdc1
Y de vez en cuando:
Sep 12 23:05:17 portatil kernel: [13641.124000] pidof(20629): dirtied inode
2858859 (exe) on proc Sep 12 23:05:17 portatil kernel: [13641.124000]
pidof(20629): dirtied inode 2858862 (exe) on proc Sep 12 23:05:17 portatil
kernel: [13641.124000] pidof(20629): dirtied inode 2858865 (exe) on proc
Sep 12 23:05:17 portatil kernel: [13641.184000] bash(5690): dirtied inode
4026531950 (block_dump) on proc Sep 12 23:05:18 portatil kernel:
[13628.804000] syslogd(4860): dirtied inode 634209 (auth.log) on hdc1 Sep
12 23:05:18 portatil kernel: [13628.804000] syslogd(4860): dirtied inode
634209 (auth.log) on hdc1 Sep 12 23:05:18 portatil kernel: [13628.804000]
syslogd(4860): WRITE block 1968 on hdc1
Esto tiene pinta de fallo de disco, ¿verdad?
No, no es eso.
Gracias a este link he encontrado el problema:
http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg92336.html
Ocurre, y esto es lo que tengo que investigar a fondo, que mi auth.log está
todo loco:
Sep 12 23:22:01 portatil su[19068]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19068]: (pam_unix) session closed for user ibc
Sep 12 23:22:01 portatil su[19092]: Successful su for ibc by root
Sep 12 23:22:01 portatil su[19092]: + ??? root:ibc
Sep 12 23:22:01 portatil su[19092]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19092]: (pam_unix) session closed for user ibc
Sep 12 23:22:01 portatil su[19116]: Successful su for ibc by root
Sep 12 23:22:01 portatil su[19116]: + ??? root:ibc
Sep 12 23:22:01 portatil su[19116]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19116]: (pam_unix) session closed for user ibc
Sep 12 23:22:01 portatil su[19140]: Successful su for ibc by root
Sep 12 23:22:01 portatil su[19140]: + ??? root:ibc
Sep 12 23:22:01 portatil su[19140]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19140]: (pam_unix) session closed for user ibc
Sep 12 23:22:01 portatil su[19164]: Successful su for ibc by root
Sep 12 23:22:01 portatil su[19164]: + ??? root:ibc
Sep 12 23:22:01 portatil su[19164]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19164]: (pam_unix) session closed for user ibc
Sep 12 23:22:01 portatil su[19188]: Successful su for ibc by root
Sep 12 23:22:01 portatil su[19188]: + ??? root:ibc
Sep 12 23:22:01 portatil su[19188]: (pam_unix) session opened for user ibc by
(uid=0)
Sep 12 23:22:01 portatil su[19188]: (pam_unix) session closed for user ibc
Así todo el rato sin parar. Y resulta que en syslog.conf estaba dicho fichero
sin un - delante, luego se sincroniza el fichero inemdiatamente tras cada
lectura.
Ha sido poner un - al auth.log y corregirse el acceso de escritura. Ahora el
problema es averiguar porqué mi auth.log está loco.
Muchas gracias sobre todo a Iñigo.
--
Iñaki Baz Castillo
