What does this mean ?

What does this mean ?

[Frederic Gobin]

Hi there everybody,

I have one question :

	Each time I look into my firewall logs, I see many dropped packets 
that match this pattern :

	Protocol 		: TCP
	Source port	: 80
	Dest port		: 1024-65535
	Flags		: ACK FIN

Where are those packets comming from ?

Thanks for reading and Thanks for each answer I get ...

Frederic Gobin

Re: What does this mean ?

[Raymond Leach]

[-- Attachment #1: Type: text/plain, Size: 1337 bytes --]

That would be IE clients browsing the web. IE is the only browser I've
found that does this.

On Wed, 2003-03-19 at 11:51, Frederic Gobin wrote:
> Hi there everybody,
> 
> I have one question :
> 
> 	Each time I look into my firewall logs, I see many dropped packets 
> that match this pattern :
> 
> 	Protocol 		: TCP
> 	Source port	: 80
> 	Dest port		: 1024-65535
> 	Flags		: ACK FIN
> 
> Where are those packets comming from ?
> 
> Thanks for reading and Thanks for each answer I get ...
> 
> Frederic Gobin
-- 
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(  Raymond Leach                       )
 ) Knowledge Factory                  (
(                                      )
 ) Tel: +27 11 445 8100               (
(  Fax: +27 11 445 8101                )
 )                                    (
(  http://www.knowledgefactory.co.za/  )
 ) http://www.saptg.co.za/            (
(  http://www.mapnet.co.za/            )
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   o                                o
    o                              o
        .--.                  .--.
       | o_o|                |o_o |
       | \_:|                |:_/ |
      / /   \\              //   \ \
     ( |     |)            (|     | )
     /`\_   _/'\          /'\_   _/`\
     \___)=(___/          \___)=(___/


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: What does this mean ?

[Frederic Gobin]

So I can add a rule to drop thos packets without having any problems ?
(That could clear the logs a bit ;-))

Frederic Gobin

Am Mittwoch, 19.03.03 um 12:05 Uhr schrieb Raymond Leach:

> That would be IE clients browsing the web. IE is the only browser I've
> found that does this.
>
> On Wed, 2003-03-19 at 11:51, Frederic Gobin wrote:
>> Hi there everybody,
>>
>> I have one question :
>>
>> 	Each time I look into my firewall logs, I see many dropped packets
>> that match this pattern :
>>
>> 	Protocol 		: TCP
>> 	Source port	: 80
>> 	Dest port		: 1024-65535
>> 	Flags		: ACK FIN
>>
>> Where are those packets comming from ?
>>
>> Thanks for reading and Thanks for each answer I get ...
>>
>> Frederic Gobin
> -- 
>  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> (  Raymond Leach                       )
>  ) Knowledge Factory                  (
> (                                      )
>  ) Tel: +27 11 445 8100               (
> (  Fax: +27 11 445 8101                )
>  )                                    (
> (  http://www.knowledgefactory.co.za/  )
>  ) http://www.saptg.co.za/            (
> (  http://www.mapnet.co.za/            )
>  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>    o                                o
>     o                              o
>         .--.                  .--.
>        | o_o|                |o_o |
>        | \_:|                |:_/ |
>       / /   \\              //   \ \
>      ( |     |)            (|     | )
>      /`\_   _/'\          /'\_   _/`\
>      \___)=(___/          \___)=(___/
>
> <signature.asc>

what does this mean?

[Steve Iribarne (GMail)]

My code is hitting in sched.c ->

=09if (unlikely(in_interrupt())) {
=09=09printk("Scheduling in interrupt\n");
=09=09BUG();
=09}
It is hitting this printk.  So is this telling me I'm calling schedule
from within an interrupt?  How can this be?  Has anyone else seen
something like this and can anyone give me a hint as to what to look
for.

Thanks.
-stv

Re: what does this mean?

[Walter L. Wimer III]

On Tue, 2006-05-16 at 09:51 -0700, Steve Iribarne (GMail) wrote:
> My code is hitting in sched.c ->
> 
> 	if (unlikely(in_interrupt())) {
> 		printk("Scheduling in interrupt\n");
> 		BUG();
> 	}
> It is hitting this printk.  So is this telling me I'm calling schedule
> from within an interrupt?  How can this be?  Has anyone else seen
> something like this and can anyone give me a hint as to what to look
> for.

Check to make sure that in your interrupt handler you are not calling
something that can sleep.  E.g. sleep(), usleep(), kmalloc(), vmalloc(),
etc. 


> Thanks.
> -stv


Best regards,

Walt Wimer
TimeSys Corporation

Re: what does this mean?

[Walter L. Wimer III]

On Tue, 2006-05-16 at 13:38 -0400, Walter L. Wimer III wrote:
> Check to make sure that in your interrupt handler you are not calling
> something that can sleep.  E.g. sleep(), usleep(), kmalloc(),
> vmalloc(), etc. 

Also watch out for semaphore operations such as down() and
down_interruptible().  They can sleep too.


Walt

Re: what does this mean?

[Steve Iribarne (GMail)]

Thanks.  That's what I think it is, but I didn't write this code so
I'm trying to track down
who is calling down at interrupt time.



On 5/16/06, Walter L. Wimer III <walt.wimer@timesys.com> wrote:
> On Tue, 2006-05-16 at 13:38 -0400, Walter L. Wimer III wrote:
> > Check to make sure that in your interrupt handler you are not calling
> > something that can sleep.  E.g. sleep(), usleep(), kmalloc(),
> > vmalloc(), etc.
>
> Also watch out for semaphore operations such as down() and
> down_interruptible().  They can sleep too.
>
>
> Walt
>
>
>

What does this mean?

[Andrea Parenti]

.../lm_sensors-2.6.4/prog/detect/sensors-detect

gives this result:
...
Probing for `Winbond W83697HF'
   Trying address 0x0290... Success!
     (confidence 8, driver `Unwritten (W83697HF)')
...

Does it mean that "there is no driver for the chip "Winbond w83697hf"??
But i read that the driver w83781d should fit.

If I do:

modprobe w83781d

I got "No sensors found!"

This is my "lsmod":

inux:/home/andrea # lsmod
Module                  Size  Used by    Tainted: P
w83781d                16672   0  (unused)
i2c-proc                6016   0  [w83781d]
pppoe                   6752   1  (autoclean)
pppox                   1064   1  (autoclean) [pppoe]
af_packet              11528   1  (autoclean)
ppp_generic            14984   3  (autoclean) [pppoe pppox]
slhc                    4432   0  (autoclean) [ppp_generic]
snd-mixer-oss          11136   1  (autoclean)
agpgart                29664   3  (autoclean)
NVdriver              989760  10  (autoclean)
parport_pc             25448   1  (autoclean)
lp                      5824   0  (autoclean)
parport                21856   1  (autoclean) [parport_pc lp]
snd-seq-midi            4480   0  (autoclean) (unused)
snd-emu10k1-synth       5504   0  (autoclean)
snd-emux-synth         28480   0  (autoclean) [snd-emu10k1-synth]
snd-seq-midi-emul       4560   0  (autoclean) [snd-emux-synth]
snd-seq-virmidi         3720   0  (autoclean) [snd-emux-synth]
snd-seq-oss            24128   0  (autoclean)
snd-seq-midi-event      2664   0  (autoclean) [snd-seq-midi 
snd-seq-virmidi snd-seq-oss]
snd-seq                39596   2  (autoclean) [snd-seq-midi 
snd-emux-synth snd-seq-midi-emul snd-seq-virmidi snd-seq-oss 
snd-seq-midi-event]
snd-emu10k1            62820   1  [snd-emu10k1-synth]
snd-pcm                58528   0  [snd-emu10k1]
snd-timer              11456   0  [snd-seq snd-pcm]
snd-hwdep               4736   0  [snd-emu10k1]
snd-util-mem            1472   0  [snd-emux-synth snd-emu10k1]
snd-rawmidi            13536   0  [snd-seq-midi snd-seq-virmidi snd-emu10k1]
ipv6                  123424  -1  (autoclean)
snd-seq-device          4336   0  [snd-seq-midi snd-emu10k1-synth 
snd-emux-synth snd-seq-oss snd-seq snd-emu10k1 snd-rawmidi]
snd-ac97-codec         24196   0  [snd-emu10k1]
snd                    31720   0  [snd-mixer-oss snd-seq-midi 
snd-emu10k1-synth snd-emux-synth snd-seq-midi-emul snd-seq-virmidi 
snd-seq-oss snd-seq-midi-event snd-seq snd-emu10k1 snd-pcm snd-timer 
snd-hwdep snd-util-mem snd-rawmidi snd-seq-device snd-ac97-codec]
soundcore               3268   7  [snd]
isa-pnp                27816   0  (unused)
joydev                  5728   0  (unused)
evdev                   3904   0  (unused)
mousedev                3872   1
hid                    17824   0  (unused)
input                   3072   0  [joydev evdev mousedev hid]
st                     25844   0  (autoclean) (unused)
sg                     23620   0  (autoclean)
3c59x                  25032   1
ipt_REJECT              2752   1  (autoclean)
ipt_LOG                 3168   1  (autoclean)
iptable_nat            12756   0  (autoclean) (unused)
ip_conntrack           12652   1  (autoclean) [iptable_nat]
iptable_filter          1728   1  (autoclean)
ip_tables              10400   6  [ipt_REJECT ipt_LOG iptable_nat 
iptable_filter]
i2c-isa                 1220   0  (unused)
i2c-core               12320   0  [w83781d i2c-proc i2c-isa]
usb-uhci               20996   0  (unused)
usbcore                55136   1  [hid usb-uhci]
ide-scsi                7648   0
reiserfs              158816   1
linux:/home/andrea # sensors -s
No sensors found!


Any help appreciated!!
Motherboard: Epox 8KHA+
System: SuSE linux 8.0.

What does this mean?

[Mark D. Studebaker]

you must not really be running sensors-detect from our 2.6.4 release.
We added support for the 697HF in 2.6.3.


Andrea Parenti wrote:
> 
> .../lm_sensors-2.6.4/prog/detect/sensors-detect
> 
> gives this result:
> ...
> Probing for `Winbond W83697HF'
>    Trying address 0x0290... Success!
>      (confidence 8, driver `Unwritten (W83697HF)')
> ...
> 
> Does it mean that "there is no driver for the chip "Winbond w83697hf"??
> But i read that the driver w83781d should fit.
> 
> If I do:
> 
> modprobe w83781d
> 
> I got "No sensors found!"
> 
> This is my "lsmod":
> 
> inux:/home/andrea # lsmod
> Module                  Size  Used by    Tainted: P
> w83781d                16672   0  (unused)
> i2c-proc                6016   0  [w83781d]
> pppoe                   6752   1  (autoclean)
> pppox                   1064   1  (autoclean) [pppoe]
> af_packet              11528   1  (autoclean)
> ppp_generic            14984   3  (autoclean) [pppoe pppox]
> slhc                    4432   0  (autoclean) [ppp_generic]
> snd-mixer-oss          11136   1  (autoclean)
> agpgart                29664   3  (autoclean)
> NVdriver              989760  10  (autoclean)
> parport_pc             25448   1  (autoclean)
> lp                      5824   0  (autoclean)
> parport                21856   1  (autoclean) [parport_pc lp]
> snd-seq-midi            4480   0  (autoclean) (unused)
> snd-emu10k1-synth       5504   0  (autoclean)
> snd-emux-synth         28480   0  (autoclean) [snd-emu10k1-synth]
> snd-seq-midi-emul       4560   0  (autoclean) [snd-emux-synth]
> snd-seq-virmidi         3720   0  (autoclean) [snd-emux-synth]
> snd-seq-oss            24128   0  (autoclean)
> snd-seq-midi-event      2664   0  (autoclean) [snd-seq-midi
> snd-seq-virmidi snd-seq-oss]
> snd-seq                39596   2  (autoclean) [snd-seq-midi
> snd-emux-synth snd-seq-midi-emul snd-seq-virmidi snd-seq-oss
> snd-seq-midi-event]
> snd-emu10k1            62820   1  [snd-emu10k1-synth]
> snd-pcm                58528   0  [snd-emu10k1]
> snd-timer              11456   0  [snd-seq snd-pcm]
> snd-hwdep               4736   0  [snd-emu10k1]
> snd-util-mem            1472   0  [snd-emux-synth snd-emu10k1]
> snd-rawmidi            13536   0  [snd-seq-midi snd-seq-virmidi snd-emu10k1]
> ipv6                  123424  -1  (autoclean)
> snd-seq-device          4336   0  [snd-seq-midi snd-emu10k1-synth
> snd-emux-synth snd-seq-oss snd-seq snd-emu10k1 snd-rawmidi]
> snd-ac97-codec         24196   0  [snd-emu10k1]
> snd                    31720   0  [snd-mixer-oss snd-seq-midi
> snd-emu10k1-synth snd-emux-synth snd-seq-midi-emul snd-seq-virmidi
> snd-seq-oss snd-seq-midi-event snd-seq snd-emu10k1 snd-pcm snd-timer
> snd-hwdep snd-util-mem snd-rawmidi snd-seq-device snd-ac97-codec]
> soundcore               3268   7  [snd]
> isa-pnp                27816   0  (unused)
> joydev                  5728   0  (unused)
> evdev                   3904   0  (unused)
> mousedev                3872   1
> hid                    17824   0  (unused)
> input                   3072   0  [joydev evdev mousedev hid]
> st                     25844   0  (autoclean) (unused)
> sg                     23620   0  (autoclean)
> 3c59x                  25032   1
> ipt_REJECT              2752   1  (autoclean)
> ipt_LOG                 3168   1  (autoclean)
> iptable_nat            12756   0  (autoclean) (unused)
> ip_conntrack           12652   1  (autoclean) [iptable_nat]
> iptable_filter          1728   1  (autoclean)
> ip_tables              10400   6  [ipt_REJECT ipt_LOG iptable_nat
> iptable_filter]
> i2c-isa                 1220   0  (unused)
> i2c-core               12320   0  [w83781d i2c-proc i2c-isa]
> usb-uhci               20996   0  (unused)
> usbcore                55136   1  [hid usb-uhci]
> ide-scsi                7648   0
> reiserfs              158816   1
> linux:/home/andrea # sensors -s
> No sensors found!
> 
> Any help appreciated!!
> Motherboard: Epox 8KHA+
> System: SuSE linux 8.0.

What does this mean?

[Michael Paul]

    Hi there...

 I get the following message when cat'ing /proc/mdstat:

md0 : active linear [dev 08:30] [8]  [dev 08:20] [7]  hdj[6]  hdi[5]  hdh[4]
hdg[3]  hde[2]  hdc[1]  hdb[0]
182485184 blocks 4k rounding

 In my raidtab file, sdc = 7 and sdd = 8. Is there some type of error here?
The linear seems to be working properly, but since I'm such a newbie, I
can't tell for sure. I wish there was a better way to check on the raid
status.

Thanks,
Michael

Re: What does this mean?

[Paul Clements]

Michael Paul wrote:
> 
>     Hi there...
> 
>  I get the following message when cat'ing /proc/mdstat:
> 
> md0 : active linear [dev 08:30] [8]  [dev 08:20] [7] 

                           ^^^^^            ^^^^^

Well, you're in luck, because these numbers are the major and minors for
sdc and sdd:

$ ls -l /dev/sdd
brw-rw----    1 root     disk       8,  48 May  5  1998 /dev/sdd
$ ls -l /dev/sdc
brw-rw----    1 root     disk       8,  32 May  5  1998 /dev/sdc

(hex 20 and 30 => decimal 32 and 48)

I'm not sure why md sometimes puts the major:minor instead of the device
name. Perhaps has something to do with the driver for your sdc and sdd?
I'm guessing here...

--
Paul




 hdj[6]  hdi[5]  hdh[4]
> hdg[3]  hde[2]  hdc[1]  hdb[0]
> 182485184 blocks 4k rounding
> 
>  In my raidtab file, sdc = 7 and sdd = 8. Is there some type of error here?
> The linear seems to be working properly, but since I'm such a newbie, I
> can't tell for sure. I wish there was a better way to check on the raid
> status.
> 
> Thanks,
> Michael
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-raid" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

What does this mean?

[Raymond Leach]

Hi

I see this in my firewall log:
Feb 27 16:51:19 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
SRC=10.0.0.67 DST=68.84.228.144 LEN=60 TOS=0x00 PREC=0x00 TTL=63
ID=64368 DF PROTO=TCP SPT=54767 DPT=0 WINDOW=5840 RES=0x00 CWR ECE SYN
URGP=0

What is DPT=0? I've never heard of using port 0 ...

What is CWR ECE SYN? Are they TCP flags? If so, what is CWR ECE ?

Ray

-- 

Re: What does this mean?

[Maciej Soltysiak]

> I see this in my firewall log:
> Feb 27 16:51:19 firefly kernel: DROP FORWARD INTERNAL: IN=eth2 OUT=eth0
> SRC=10.0.0.67 DST=68.84.228.144 LEN=60 TOS=0x00 PREC=0x00 TTL=63
> ID=64368 DF PROTO=TCP SPT=54767 DPT=0 WINDOW=5840 RES=0x00 CWR ECE SYN
> URGP=0
>
> What is DPT=0? I've never heard of using port 0 ...
No services there, this packet is certainly invalid. Some OS's respond to
them with tcp rst, some just drop them.

> What is CWR ECE SYN? Are they TCP flags? If so, what is CWR ECE ?
Yes they are TCP flags, CWR & ECE are ECN extensions to the TCP header.
Read RFC 3168.

Note, some routers outthere are not ECN aware and violate RFC 3168 by
dropping these packets. This causes interoperability problems, which
should be resolved by vendors.

> Ray
Maciej

Re: What does this mean?

[Alexander W. Janssen]

[-- Attachment #1: Type: text/plain, Size: 791 bytes --]

On Thu, Feb 27, 2003 at 04:48:30PM +0100, Maciej Soltysiak wrote:
> Note, some routers outthere are not ECN aware and violate RFC 3168 by
> dropping these packets. This causes interoperability problems, which
> should be resolved by vendors.

At http://urchin.earth.li/cgi-bin/ecn.pl?output=ip is a list with routers with
are known to violate ECN. There is even a perl-script around wich uses the
--remove-ecn feature of the ECN target to create rules based on that list of
IP-addresses. Quite nice, since it sorts out the problem locally - but not in
a global sense. Call it self-defense.
 
> > Ray
> Maciej
Alex

-- 
"Mr Data, when I said 'Fire at Will', I didn't mean for you to be so literal."
Instructions for use of this post: Insert tounge in cheek. Read as normal.

[-- Attachment #2: Type: application/pgp-signature, Size: 248 bytes --]

What does this mean?

[Eric R. Benoit]

I saw this message in my logs, can you point me in the right direction to what
it means?
Thank You in advance,
Eric

WARNING: MP table in the EBDA can be UNSAFE, contact linux-smp@vger.kernel.org
if you experience SMP problems!

------------------------------------------------------------
Hopevale Union Free School District: http://www.hopevale.com
This mail sent through IMP: http://horde.org/imp/
Configured By Eric Benoit: mailto:ebenoit@hopevale.com

Re: What does this mean?

[Alan Cox]

On Fri, 2002-12-06 at 18:04, Eric R. Benoit wrote:
> I saw this message in my logs, can you point me in the right direction to what
> it means?
> Thank You in advance,
> Eric
> 
> WARNING: MP table in the EBDA can be UNSAFE, contact linux-smp@vger.kernel.org
> if you experience SMP problems!

Its a message we really need to drop. Very old kernel loaders used to
sometimes stomp the MP table. That was fixed about three years ago .
maybe four.

What does this mean?

[Michael Rosenthal]

Oct 27 17:01:55 enterprise kernel: Setting 2 in the phys_id_present_map
Oct 27 17:01:55 enterprise kernel: ...changing IO-APIC physical APIC ID to 2
... ok.
Oct 27 17:01:55 enterprise kernel: Setting 3 in the phys_id_present_map
Oct 27 17:01:55 enterprise kernel: ...changing IO-APIC physical APIC ID to 3
... ok.
Oct 27 17:01:55 enterprise kernel: Setting 4 in the phys_id_present_map
Oct 27 17:01:55 enterprise kernel: ...changing IO-APIC physical APIC ID to 4
... ok.
Oct 27 17:01:55 enterprise kernel: Setting 5 in the phys_id_present_map
Oct 27 17:01:55 enterprise kernel: ...changing IO-APIC physical APIC ID to 5
... ok.
Oct 27 17:01:55 enterprise kernel: Setting 8 in the phys_id_present_map
Oct 27 17:01:55 enterprise kernel: ...changing IO-APIC physical APIC ID to 8
... ok.
Oct 27 17:01:55 enterprise kernel: ..TIMER: vector=0x31 pin1=2 pin2=0
Oct 27 17:01:55 enterprise kernel: testing the IO
APIC.......................
Oct 27 17:01:55 enterprise kernel:
Oct 27 17:01:55 enterprise kernel:  WARNING: unexpected IO-APIC, please mail
Oct 27 17:01:55 enterprise kernel:           to linux-smp@vger.kernel.org
Oct 27 17:01:55 enterprise kernel:
Oct 27 17:01:55 enterprise last message repeated 3 times

What other information do you need?

Thanks,

- Mike

What does this mean?

[Basil Chupin]

I am running SuSE 8 and the HD is being accessed every 5 seconds by 
"something". I thought I would just do a quick check of the reiserfs but 
on executing "reiserfsck --check --logfile check.log  /dev/hda7" this 
produces the error message "/dev/hda7 is mounted w/ write permissions, 
can not check it." I cannot find this message documented so am wondering 
what it means, and what do I need to do in order to be able to check the 
integrity of the reiserfs on my sytem. Can anyone please help?

Cheers.

Re: What does this mean?

[Oleg Drokin]

Hello!

On Mon, Jul 08, 2002 at 11:30:13PM +1000, Basil Chupin wrote:

> I am running SuSE 8 and the HD is being accessed every 5 seconds by 
> "something". I thought I would just do a quick check of the reiserfs but 

atime updates and stuff?

> on executing "reiserfsck --check --logfile check.log  /dev/hda7" this 
> produces the error message "/dev/hda7 is mounted w/ write permissions, 
> can not check it." I cannot find this message documented so am wondering 
> what it means, and what do I need to do in order to be able to check the 
> integrity of the reiserfs on my sytem. Can anyone please help?

You can only check integrity on read-only mounted fs.
You can only fix stuff on completely unmounted fs.

Bye,
    Oleg

Re: What does this mean?

[Basil Chupin]

Oleg Drokin wrote:

>Hello!
>
>On Mon, Jul 08, 2002 at 11:30:13PM +1000, Basil Chupin wrote:
>
>  
>
>>I am running SuSE 8 and the HD is being accessed every 5 seconds by 
>>"something". I thought I would just do a quick check of the reiserfs but 
>>    
>>
>
>atime updates and stuff?
>  
>
I really do not know what is causing this every-5-seconds access. This 
is why I am trying to check the integrity of the fs as part of my 
exercise of finding the reason for the access.

>>on executing "reiserfsck --check --logfile check.log  /dev/hda7" this 
>>produces the error message "/dev/hda7 is mounted w/ write permissions, 
>>can not check it." I cannot find this message documented so am wondering 
>>what it means, and what do I need to do in order to be able to check the 
>>integrity of the reiserfs on my sytem. Can anyone please help?
>>    
>>
>You can only check integrity on read-only mounted fs.
>You can only fix stuff on completely unmounted fs.
>
>Bye,
>    Oleg
>
>.
>
Someone else responded to me earlier with the statement to execute 
following: "mount -o remount,rw  /dev/hda7" which I thought had the "rw" 
wrong; but by changing the "rw" to "ro" I then got the error message, 
"mount: / busy".

All this is perplexing me, firstly because I am not tryng to change 
anything- all I am trying to do is to do what the blurb about reiserfs 
says which is "do this to CHECK the fs"; and secondly, how could one 
ever effect any corrections to the fs if it cannot be mounted!?

All too much for a country lad to fathom.

Cheers.

Re: What does this mean?

[Kuba Ober]

> >>on executing "reiserfsck --check --logfile check.log  /dev/hda7" this
> >>produces the error message "/dev/hda7 is mounted w/ write permissions,
> >>can not check it." I cannot find this message documented so am wondering
> >>what it means, and what do I need to do in order to be able to check the
> >>integrity of the reiserfs on my sytem. Can anyone please help?
> >
> >You can only check integrity on read-only mounted fs.
> >You can only fix stuff on completely unmounted fs.

> All this is perplexing me, firstly because I am not tryng to change
> anything- all I am trying to do is to do what the blurb about reiserfs
> says which is "do this to CHECK the fs"; and secondly, how could one
> ever effect any corrections to the fs if it cannot be mounted!?

To *check* the filesystem at all, mount it in read-only mode. Oftentimes you 
need to stop most services to do that, say go to singleuser mode via
# telinit 1

To *fix* the filesystem, it *must* be unmounted, period. Typically, you will 
want to make a minimal "rescue" root partition on your hard drive, reboot 
with this partition given to kernel as the root (root=/dev/hdxxxx), and then 
run reiserfsck on your main root partition.

Cheers, Kuba Ober

Re: What does this mean?

[Kuba Ober]

> I really do not know what is causing this every-5-seconds access. This
> is why I am trying to check the integrity of the fs as part of my
> exercise of finding the reason for the access.

This is normal and expected for your kernel version, AFAIK. Integrity of the 
fs has nothing to do with it (alas, do maintain the integrity, please ;-)

Cheers, Kuba Ober

Re: What does this mean?

[Basil Chupin]

Kuba Ober wrote:

 >>I really do not know what is causing this every-5-seconds access. This
 >>is why I am trying to check the integrity of the fs as part of my
 >>exercise of finding the reason for the access.
 >>
 >>
 >This is normal and expected for your kernel version, AFAIK. Integrity 
of the
 >fs has nothing to do with it (alas, do maintain the integrity, please ;-)
 >
 >Cheers, Kuba Ober
 >
 >
 >
I take the opporunity in this message to thank all who have responded to
my queries as doing so will save me some typing :-).

Re what you just said about this being "normal and expected for your
kernel version, AFAIK" I need to say that this is the reason why I am
querying this accessing because I don't believe that it is - and i'll
give my reason in a minute. Firstly, I want to say that  following advice
from at least a couple of people I was able to work out (I am new to
Linux so don't really know what I am doing) how to check the reiser fs
on my system. It is fine, of course. I needed to have it checked out,
though, because I had to eliminate this as a variable in my attempt to
find out why my HD(s) is/are being accessed by something every 5 seconds.

Please let me give a brief resume of why I am trying to find out why my 
HD is being accessed every 5 seconds (actually it is also occurring on 
another computer at home and a friend's machine -- and all are running 
SuSE 8.0).

  I first asked this Q isn another forum and received the general reply 
that it all had to do with the reiser fs -- which I didn't really 
believe. Why? because I didn't recall having this "problem" when I was 
running SuSE v7.2 with reiser fs. But just to be sure I started doing 
some testing.

I have another HD which I use for testing purposes and on this one I 
installed SuSE v7.2 undere reiserfs. There was no 5 second accessing on 
the HD.

I then installed SuSE 8 with ext3 (because someone said that the 5 
seconds-thingie only happened under reiser) - and I still got the 5 secs 
access. So, it wasn't confined to reiserfs.

Following the comment in this forum that I can only run reiserfsck if 
the fs is not mounted or if I am in single-user mode, I went into 
single-user mode and guess what? As soon as one goes into single-user 
mode the 5 second accessing stops! Interesting, no?

And just to add more interest to the whole epic, I decided to do another 
  install of SuSE 8 under reiserfs on my test drive. I did an identical 
install as I made on my other 2 computers and --- you guessed it: this 
time there is NO 5 second accessing of the HD (on the test system)!

So, that's the story, and I am still wondering why 3 systems runing SuSE 
8 under reiserfs are having the HDs accessed every 5 seconds yet this 
does not occur on a (near identical) test system installed recently.

Cheers.

Re: What does this mean?

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 1245 bytes --]

On Fri, 12 Jul 2002 15:48:27 +1000, Basil Chupin said:

> Please let me give a brief resume of why I am trying to find out why my 
> HD is being accessed every 5 seconds (actually it is also occurring on 
> another computer at home and a friend's machine -- and all are running 
> SuSE 8.0).
> 
>   I first asked this Q isn another forum and received the general reply 
> that it all had to do with the reiser fs -- which I didn't really 
> believe. Why? because I didn't recall having this "problem" when I was 
> running SuSE v7.2 with reiser fs. But just to be sure I started doing 
> some testing.
> 
> I have another HD which I use for testing purposes and on this one I 
> installed SuSE v7.2 undere reiserfs. There was no 5 second accessing on 
> the HD.
> 
> I then installed SuSE 8 with ext3 (because someone said that the 5 
> seconds-thingie only happened under reiser) - and I still got the 5 secs 
> access. So, it wasn't confined to reiserfs.

Note that ext3 *also* has a 'kjournald' that ticks every 5 seconds.

I'm willing to bet that the system that wasn't seeing the ticking had all
the filesystems mounted as ext2, which doesn't have a journal.
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech


[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]

Re: What does this mean?

[Basil Chupin]

Valdis.Kletnieks@vt.edu wrote:

>On Fri, 12 Jul 2002 15:48:27 +1000, Basil Chupin said:
>
>  
>
>>Please let me give a brief resume of why I am trying to find out why my 
>>HD is being accessed every 5 seconds (actually it is also occurring on 
>>another computer at home and a friend's machine -- and all are running 
>>SuSE 8.0).
>>
>>  I first asked this Q isn another forum and received the general reply 
>>that it all had to do with the reiser fs -- which I didn't really 
>>believe. Why? because I didn't recall having this "problem" when I was 
>>running SuSE v7.2 with reiser fs. But just to be sure I started doing 
>>some testing.
>>
>>I have another HD which I use for testing purposes and on this one I 
>>installed SuSE v7.2 undere reiserfs. There was no 5 second accessing on 
>>the HD.
>>
>>I then installed SuSE 8 with ext3 (because someone said that the 5 
>>seconds-thingie only happened under reiser) - and I still got the 5 secs 
>>access. So, it wasn't confined to reiserfs.
>>    
>>
>
>Note that ext3 *also* has a 'kjournald' that ticks every 5 seconds.
>  
>
Ah, so it has similarities with reiser.

>I'm willing to bet that the system that wasn't seeing the ticking had all
>the filesystems mounted as ext2, which doesn't have a journal.
>  
>
Had you bet you would have lost! :-). All systems are operating under 
reiserfs.

You mentioning kjournald brought to min a conversation I had with a 
friend of mine who tends to have a similar approach to me when starting 
to run a new system (Linux [SuSE] in this case) and who also uses a 
second HD to test new installations before putting them onto the 'main' 
system.

We compared the outputs from the 'ps aux' command and what I found is 
that I am not running the kjournald process on any of my (3) 'systems' 
 while he is (on his 2 'systems') even though our setups are almost 
identical (with regards to running SuSE v8 ). I thought kjournald was 
part and parcel of reiserfs but then why isn't it running on my 
'systems'? Just another mystery.

Anyway, I think I have found the reason why I (and my friend and some 
other(s)) am having the HD accessed every 5 seconds, and after I have 
re-checked my finding I'll post the reason. It may not have anything 
directly to do with reiserfs but it may be  that another application may 
be causing reiserfs to misbehave (in this 5-second syndrome) or, of 
course, it has a bug in it causing the kernel to do the 'wrong thing' 
(the application does a patch to the kernel).

Cheers.

Re: What does this mean?

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 750 bytes --]

On Sat, 13 Jul 2002 19:59:55 +1000, Basil Chupin <blchupin@tpg.com.au>  said:

> We compared the outputs from the 'ps aux' command and what I found is 
> that I am not running the kjournald process on any of my (3) 'systems' 
>  while he is (on his 2 'systems') even though our setups are almost 
> identical (with regards to running SuSE v8 ). I thought kjournald was 
> part and parcel of reiserfs but then why isn't it running on my 
> 'systems'? Just another mystery.

ext2 filesystems don't have a kernel thread.
ext3 have one kjournald thread per file system.
resierfs have one kreiserfsd thread per file system.

You don't have any because you're all reiserfs.  His two systems obviously
have at least 1 ext3 file system (/boot or / perhaps?)

[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]

Re: What does this mean?

[Basil Chupin]

Valdis.Kletnieks@vt.edu wrote:

>On Sat, 13 Jul 2002 19:59:55 +1000, Basil Chupin <blchupin@tpg.com.au>  said:
>
>  
>
>>We compared the outputs from the 'ps aux' command and what I found is 
>>that I am not running the kjournald process on any of my (3) 'systems' 
>> while he is (on his 2 'systems') even though our setups are almost 
>>identical (with regards to running SuSE v8 ). I thought kjournald was 
>>part and parcel of reiserfs but then why isn't it running on my 
>>'systems'? Just another mystery.
>>    
>>
>
>ext2 filesystems don't have a kernel thread.
>ext3 have one kjournald thread per file system.
>resierfs have one kreiserfsd thread per file system.
>
>You don't have any because you're all reiserfs.
>
I learn someting new every day. Thanks for this information. And, Yes I 
do only have reiserfs installed.

>  His two systems obviously
>have at least 1 ext3 file system (/boot or / perhaps?)
>  
>
Ah, now this is something I believe he does not have. Like me he 
installs everything under the one file system. Howeve, I will check with 
him just in case he somehow misconfigured his system by accident (or 
design).

Cheers.

Re: What does this mean?

[Basil Chupin]

Basil Chupin wrote:

> Valdis.Kletnieks@vt.edu wrote:
>
>> On Fri, 12 Jul 2002 15:48:27 +1000, Basil Chupin said:
>>
>>  
>>
>>> Please let me give a brief resume of why I am trying to find out why 
>>> my HD is being accessed every 5 seconds (actually it is also 
>>> occurring on another computer at home and a friend's machine -- and 
>>> all are running SuSE 8.0).
>>>
>>>  I first asked this Q isn another forum and received the general 
>>> reply that it all had to do with the reiser fs -- which I didn't 
>>> really believe. Why? because I didn't recall having this "problem" 
>>> when I was running SuSE v7.2 with reiser fs. But just to be sure I 
>>> started doing some testing.
>>>
>>> I have another HD which I use for testing purposes and on this one I 
>>> installed SuSE v7.2 undere reiserfs. There was no 5 second accessing 
>>> on the HD.
>>>
>>> I then installed SuSE 8 with ext3 (because someone said that the 5 
>>> seconds-thingie only happened under reiser) - and I still got the 5 
>>> secs access. So, it wasn't confined to reiserfs.
>>>   
>>
>>
>> Note that ext3 *also* has a 'kjournald' that ticks every 5 seconds.
>>  
>>
> Ah, so it has similarities with reiser.
>
>> I'm willing to bet that the system that wasn't seeing the ticking had all
>> the filesystems mounted as ext2, which doesn't have a journal.
>>  
>>
> Had you bet you would have lost! :-). All systems are operating under 
> reiserfs.
>
> You mentioning kjournald brought to min a conversation I had with a 
> friend of mine who tends to have a similar approach to me when 
> starting to run a new system (Linux [SuSE] in this case) and who also 
> uses a second HD to test new installations before putting them onto 
> the 'main' system.
>
> We compared the outputs from the 'ps aux' command and what I found is 
> that I am not running the kjournald process on any of my (3) 'systems' 
> while he is (on his 2 'systems') even though our setups are almost 
> identical (with regards to running SuSE v8 ). I thought kjournald was 
> part and parcel of reiserfs but then why isn't it running on my 
> 'systems'? Just another mystery.
>
> Anyway, I think I have found the reason why I (and my friend and some 
> other(s)) am having the HD accessed every 5 seconds, and after I have 
> re-checked my finding I'll post the reason. It may not have anything 
> directly to do with reiserfs but it may be  that another application 
> may be causing reiserfs to misbehave (in this 5-second syndrome) or, 
> of course, it has a bug in it causing the kernel to do the 'wrong 
> thing' (the application does a patch to the kernel).
>
> Cheers.
>
I apologise for the delay in following-up on this topic but I have been 
occupied on other things (including upgrading my system).

What I found is that, at least in my case (and my friend's), the 
5-second accessing of the HD is caused by Win4Lin. As soon as I/we boot 
into SuSE without the win4lin kernel the accessing stops and the system 
is quiet as a mouse. I am in touch with NeTraverse (Win4Lin) and they 
are investigating this matter.

In a different forum someone mentioned that when he un-installed 
seti-at-home the 5-second accessing on his system stopped - I mention 
this in case this is of interest to anyone.

I did some extensive (for me, that is :-)) testing and found that the 
5-second accessing occurs when either reiser or ext3 file systems are 
installed but the access time "drops" to once every 35 seconds if ext2 
fs is used. Interesting (?).

Cheers.

Re: What does this mean?

[Oleg Drokin]

Hello!

On Tue, Jul 09, 2002 at 02:13:51AM +1000, Basil Chupin wrote:

> >>I am running SuSE 8 and the HD is being accessed every 5 seconds by 
> >>"something". I thought I would just do a quick check of the reiserfs but 
> >atime updates and stuff?
> I really do not know what is causing this every-5-seconds access. This 
> is why I am trying to check the integrity of the fs as part of my 
> exercise of finding the reason for the access.

Integrity have nothing to do with that with 99.9% probability.

> >>on executing "reiserfsck --check --logfile check.log  /dev/hda7" this 
> >>produces the error message "/dev/hda7 is mounted w/ write permissions, 
> >>can not check it." I cannot find this message documented so am wondering 
> >>what it means, and what do I need to do in order to be able to check the 
> >>integrity of the reiserfs on my sytem. Can anyone please help?
> >You can only check integrity on read-only mounted fs.
> >You can only fix stuff on completely unmounted fs.
> Someone else responded to me earlier with the statement to execute 
> following: "mount -o remount,rw  /dev/hda7" which I thought had the "rw" 
> wrong; but by changing the "rw" to "ro" I then got the error message, 
> "mount: / busy".

Sure. You can do this in single user mode, though.

> All this is perplexing me, firstly because I am not tryng to change 
> anything- all I am trying to do is to do what the blurb about reiserfs 
> says which is "do this to CHECK the fs"; and secondly, how could one 
> ever effect any corrections to the fs if it cannot be mounted!?

This is a balanced tree filesystem, so metadata flies all over the place on
disk, so to ensure metadata stability, for check you need your volume to
at least to be mounted read only.

Bye,
    Oleg

Re: What does this mean?

[Basil Chupin]

Oleg Drokin wrote:

 >Hello!
 >
 >On Tue, Jul 09, 2002 at 02:13:51AM +1000, Basil Chupin wrote:
 >
 >
 >
 >>>>I am running SuSE 8 and the HD is being accessed every 5 seconds by
 >>>>"something". I thought I would just do a quick check of the 
reiserfs but
 >>>>
 >>>>
 >>>atime updates and stuff?
 >>>
 >>>
 >>I really do not know what is causing this every-5-seconds access. This
 >>is why I am trying to check the integrity of the fs as part of my
 >>exercise of finding the reason for the access.
 >>
 >>
 >
 >Integrity have nothing to do with that with 99.9% probability.
 >
 >
 >
 >>>>on executing "reiserfsck --check --logfile check.log  /dev/hda7" this
 >>>>produces the error message "/dev/hda7 is mounted w/ write permissions,
 >>>>can not check it." I cannot find this message documented so am 
wondering
 >>>>what it means, and what do I need to do in order to be able to 
check the
 >>>>integrity of the reiserfs on my sytem. Can anyone please help?
 >>>>
 >>>>
 >>>You can only check integrity on read-only mounted fs.
 >>>You can only fix stuff on completely unmounted fs.
 >>>
 >>>
 >>Someone else responded to me earlier with the statement to execute
 >>following: "mount -o remount,rw  /dev/hda7" which I thought had the "rw"
 >>wrong; but by changing the "rw" to "ro" I then got the error message,
 >>"mount: / busy".
 >>
 >>
 >
 >Sure. You can do this in single user mode, though.
 >
 >
 >
 >>All this is perplexing me, firstly because I am not tryng to change
 >>anything- all I am trying to do is to do what the blurb about reiserfs
 >>says which is "do this to CHECK the fs"; and secondly, how could one
 >>ever effect any corrections to the fs if it cannot be mounted!?
 >>
 >>
 >
 >This is a balanced tree filesystem, so metadata flies all over the 
place on
 >disk, so to ensure metadata stability, for check you need your volume to
 >at least to be mounted read only.
 >
 >Bye,
 >    Oleg
 >.
 >
Thank you for the explanation.  I am on a learning curve in Linux so the
above is most useful - one learns something new everyday.

Cheers.