Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #167593 > unrolled thread

ghost partition

Back to article view | Back to linux.debian.user

Contents

  ghost partition Haines Brown <haines@histomat.net> - 2016-05-09 01:50 +0200
    Re: ghost partition Andy Smith <andy@strugglers.net> - 2016-05-09 03:00 +0200
      Re: ghost partition Haines Brown <haines@histomat.net> - 2016-05-09 12:50 +0200
        Re: ghost partition Andy Smith <andy@strugglers.net> - 2016-05-09 13:10 +0200
          Re: ghost partition Haines Brown <haines@histomat.net> - 2016-05-09 14:50 +0200
            Re: ghost partition <tomas@tuxteam.de> - 2016-05-09 15:00 +0200
              Re: ghost partition Brian <ad44@cityscape.co.uk> - 2016-05-09 15:20 +0200
                Re: ghost partition <tomas@tuxteam.de> - 2016-05-09 15:40 +0200
                  Re: ghost partition Brian <ad44@cityscape.co.uk> - 2016-05-09 16:00 +0200
                    Re: ghost partition <tomas@tuxteam.de> - 2016-05-09 16:20 +0200
                      Re: ghost partition Brian <ad44@cityscape.co.uk> - 2016-05-09 17:00 +0200
                        Re: ghost partition <tomas@tuxteam.de> - 2016-05-09 17:20 +0200
                          Re: ghost partition Brian <ad44@cityscape.co.uk> - 2016-05-09 21:00 +0200
    Re: ghost partition Juergen Bausa <Juergen.Bausa@online.de> - 2016-05-09 09:40 +0200

#167593 — ghost partition

Every once in a while I get a filled root partition, and the reason in
each case is different. In the present case it seems that /dev/sde1
serves as the interface for something very large, even though the
/dev/sde1 interface does not exist and is not mounted.

# ncdu -rx /
  425.5MiB [##########]  sde1                                                  $
  198.3MiB [####      ] /lib
  193.8MiB [####      ] /mnt
  ...

$ mount | grep sde
[nothing]

# ls -la | grep sde
brw-rw---T   1 root   floppy      8,  64 May  8 11:15 sde

So the /dev/sde1 interface does not exist, but nevertheless du can access
it. 

How can I remove what has attached itself to /dev/sde1?

Haines Brown

[toc] | [next] | [standalone]

#167595

[Multipart message — attachments visible in raw view] — view raw

Hi Haines,

On Sun, May 08, 2016 at 07:48:16PM -0400, Haines Brown wrote:
> # ncdu -rx /
>   425.5MiB [##########]  sde1                                                  $
>   198.3MiB [####      ] /lib
>   193.8MiB [####      ] /mnt
>   ...

I am not familiar with ncdu but looking at its manual page, -x means
"do not cross filesystem boundaries" so I would expect that it
thinks that /dev/sde1 is your root filesystem.

> $ mount | grep sde
> [nothing]

Note that this could be a false negative because mount's idea of the
device for your root may not match reality, e.g. mount may think of
the device as an LVM volume, label path (/dev/disk/by-label/…) or
UUID path (/dev/disk/by-uuid/…).

> How can I remove what has attached itself to /dev/sde1?

I think we first have to work out what it is. What is the output of
the following commands?

$ cat /proc/mounts
$ ls -la /sys/block/sde
# blockdev --report /dev/sde
# blockdev --report /dev/sde1
$ grep sde1 /var/log/dmesg

Cheers,
Andy

-- 
http://bitfolk.com/ -- No-nonsense VPS hosting

Please consider the environment before reading this e-mail.
 — John Levine

[toc] | [prev] | [next] | [standalone]

#167607

I had been inserting a sequence of USB keys to see what was on them, and
pretty sure the sde1 interface was used at some point. But no keys are
inserted at present. I also just did a cross installation onto an
attached hard disk and so its directories were mounted locally on /mnt
and I had chroot'ed into its root directory. I suspect this was close in
time to when my root partition became filled. I unmounted these
partitions and I closed the chroot terminal. To avoid confusion I should
note that in what follows, my currently running disk is /dev/sdb, while
the new cross installation was to /dev/sda. That is, /dev/sda is the
newer disk. I should also note that /home, /usr, /var and /tmp
partitions are broken out.

  $ cat /proc/mounts
  rootfs / rootfs rw 0 0
  sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
  proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
  udev /dev devtmpfs rw,relatime,size=10240k,nr_inodes=188865,mode=755 0 0
  devpts /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0
  tmpfs /run tmpfs rw,nosuid,noexec,relatime,size=1647748k,mode=755 0 0
  /dev/disk/by-uuid/b0673fe5-e6b2-42a5-9121-5fcf32b7135d / \
        ext4 rw,relatime,errors=remount-ro,user_xattr,barrier=1,data=ordered 0 0
  tmpfs /run/lock tmpfs rw,nosuid,nodev,noexec,relatime,size=5120k 0 0
  tmpfs /run/shm tmpfs rw,nosuid,nodev,noexec,relatime,size=9545360k 0 0
  /dev/sdb5 /home ext4 rw,relatime,user_xattr,barrier=1,data=ordered 0 0
  ...

  $ ls -la /sys/block/sde
  lrwxrwxrwx 1 root root 0 May  9 05:30 /sys/block/sde ->
  ../devices/pci0000:00/0000:00:14.0/usb1/1-3/1-3.3/1-3.3:1.0/host7/target7:0:0/ \
        7:0:0:1/block/sde

  This is similar to the return from other interfaces.

  # blockdev --report /dev/sde
  RO    RA   SSZ   BSZ   StartSec            Size   Device
  rw   256   512  4096          0               0   /dev/sde

  # blockdev --report /dev/sde1
  RO    RA   SSZ   BSZ   StartSec            Size   Device
  blockdev: cannot open /dev/sde1: No such file or directory

  # grep sde1 /var/log/dmesg
  [nothing]

Juergen suggested deleting /dev/sde1 it after backing it up. That was my
first inclination, but kinda hard to do if /dev/sde1 is not visible. I
also considered just rebooting, but thought best to find out what the
problem is, and who knows I might not be able to boot. I have a second
bootable disk on the machine that automatically mounts the partitions on
my problematic drive on /mnt/debian/...., and so I can boot it and
access the current drive's partitions.

Haines

[toc] | [prev] | [next] | [standalone]

#167609

[Multipart message — attachments visible in raw view] — view raw

Hi Haines,

On Mon, May 09, 2016 at 06:43:59AM -0400, Haines Brown wrote:
> I had been inserting a sequence of USB keys to see what was on them, and
> pretty sure the sde1 interface was used at some point. But no keys are
> inserted at present. I also just did a cross installation onto an

[…]

>   $ ls -la /sys/block/sde
>   lrwxrwxrwx 1 root root 0 May  9 05:30 /sys/block/sde ->
>   ../devices/pci0000:00/0000:00:14.0/usb1/1-3/1-3.3/1-3.3:1.0/host7/target7:0:0/ \
>         7:0:0:1/block/sde

So it seems like sde is/was a USB block device.

I had thought that the "sde1" in your ncdu output was some sort of
header representing the / device, but having installed ncdu and run
it myself I am inclined to agree with Juergen that it is actually a
file.

> Juergen suggested deleting /dev/sde1 it after backing it up. That was my
> first inclination, but kinda hard to do if /dev/sde1 is not visible.

In your ncdu output it looked like you ran it while / was your
current directory, and the output it gave was just "sde1", not
"/dev/sde1". So have a look for the file /sde1.

Perhaps you have tried to write an image to a USB key at /dev/sde1
but done a typo and actually written to /sde1, thus creating that
file?

Certainly if I do this:

$ sudo du if=/dev/zero of=/sde1 bs=1M count=100
$ sudo ncdu -rx /

then I end up with a line of output that looks like what you
provided.

So, are you sure there is not just a regular file at /sde1 (not in
/dev)?

Cheers,
Andy

-- 
http://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [next] | [standalone]

#167612

On Mon, May 09, 2016 at 11:05:13AM +0000, Andy Smith wrote:
> Hi Haines,

> I had thought that the "sde1" in your ncdu output was some sort of
> header representing the / device, but having installed ncdu and run
> it myself I am inclined to agree with Juergen that it is actually a
> file.

And so it is. I must have seen /sde1, but it failed to register on my
octogenarian brain. I moved it into storage and my full disk problem is
gone. Hard to know what that file is. The file command says it is data.
It may be an ISO. I'll eventually delete it.

> Perhaps you have tried to write an image to a USB key at /dev/sde1
> but done a typo and actually written to /sde1, thus creating that
> file?

Yes, so it seems.

Thanks for the help, but should have discovered the source of the
problem on my own.

Haines

[toc] | [prev] | [next] | [standalone]

#167613

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, May 09, 2016 at 08:41:59AM -0400, Haines Brown wrote:
> On Mon, May 09, 2016 at 11:05:13AM +0000, Andy Smith wrote:
> > Hi Haines,
> 
> > I had thought that the "sde1" in your ncdu output was some sort of
> > header representing the / device, but having installed ncdu and run
> > it myself I am inclined to agree with Juergen that it is actually a
> > file.
> 
> And so it is. I must have seen /sde1, but it failed to register on my
> octogenarian brain. I moved it into storage and my full disk problem is
> gone. Hard to know what that file is. The file command says it is data.
> It may be an ISO. I'll eventually delete it.

A cheap shot: try to mount it. Either as loopback:

  mount -o loop /sde1 /mnt

or by dd'ing it first to a suitable storage (e.g. a stick).

If that suceeds, then it is a file system image *and* you can nose
around in the mount directory (/mnt in the above example) to refresh
your memory.

Of course you gotta do that as root, either by sudo magic or whatever.

> Thanks for the help, but should have discovered the source of the
> problem on my own.

Nobody's an island.

regards
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlcwh34ACgkQBcgs9XrR2ka12wCePHSetG4OveudFneH6vWi2Al8
GcMAn3iRly0CWPDDBLwF1iEqNGQedpjM
=VFCl
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#167617

On Mon 09 May 2016 at 14:50:06 +0200, tomas@tuxteam.de wrote:

> On Mon, May 09, 2016 at 08:41:59AM -0400, Haines Brown wrote:
> > On Mon, May 09, 2016 at 11:05:13AM +0000, Andy Smith wrote:
> > > Hi Haines,
> > 
> > > I had thought that the "sde1" in your ncdu output was some sort of
> > > header representing the / device, but having installed ncdu and run
> > > it myself I am inclined to agree with Juergen that it is actually a
> > > file.
> > 
> > And so it is. I must have seen /sde1, but it failed to register on my
> > octogenarian brain. I moved it into storage and my full disk problem is
> > gone. Hard to know what that file is. The file command says it is data.
> > It may be an ISO. I'll eventually delete it.
> 
> A cheap shot: try to mount it. Either as loopback:
> 
>   mount -o loop /sde1 /mnt
> 
> or by dd'ing it first to a suitable storage (e.g. a stick).
> 
> If that suceeds, then it is a file system image *and* you can nose
> around in the mount directory (/mnt in the above example) to refresh
> your memory.
> 
> Of course you gotta do that as root, either by sudo magic or whatever.

Not necessarily; udisksctl (install udisks2) and udevil are two programs
which will do this for a user. 

[toc] | [prev] | [next] | [standalone]

#167618

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, May 09, 2016 at 02:09:45PM +0100, Brian wrote:
> On Mon 09 May 2016 at 14:50:06 +0200, tomas@tuxteam.de wrote:

[...]

> > Of course you gotta do that as root, either by sudo magic or whatever.
> 
> Not necessarily; udisksctl (install udisks2) and udevil are two programs
> which will do this for a user. 

To each his/her own :-)

- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlcwkZ0ACgkQBcgs9XrR2katYQCfUr6WXytEZI65tPJCf1Oq/1gl
irEAn04+yrmQG1FqFs9gjCsaXoO7drZS
=ClNe
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#167619

On Mon 09 May 2016 at 15:33:17 +0200, tomas@tuxteam.de wrote:

> On Mon, May 09, 2016 at 02:09:45PM +0100, Brian wrote:
> > On Mon 09 May 2016 at 14:50:06 +0200, tomas@tuxteam.de wrote:
> 
> [...]
> 
> > > Of course you gotta do that as root, either by sudo magic or whatever.
> > 
> > Not necessarily; udisksctl (install udisks2) and udevil are two programs
> > which will do this for a user. 
> 
> To each his/her own :-)

Not if he/she does not have root access on the machine. :)

[toc] | [prev] | [next] | [standalone]

#167621

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, May 09, 2016 at 02:57:48PM +0100, Brian wrote:
> On Mon 09 May 2016 at 15:33:17 +0200, tomas@tuxteam.de wrote:
> 
> > On Mon, May 09, 2016 at 02:09:45PM +0100, Brian wrote:
> > > On Mon 09 May 2016 at 14:50:06 +0200, tomas@tuxteam.de wrote:
> > 
> > [...]
> > 
> > > > Of course you gotta do that as root, either by sudo magic or whatever.
> > > 
> > > Not necessarily; udisksctl (install udisks2) and udevil are two programs
> > > which will do this for a user. 
> > 
> > To each his/her own :-)
> 
> Not if he/she does not have root access on the machine. :)

If he/she successfully dumped a file to /, then he/she has.

- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlcwmmsACgkQBcgs9XrR2kbXagCfYBHVWWFDulhJ3eWpggEitC9N
zV8An00FuIC0flG4GBs0NUDpoKOyV8zP
=x0Vu
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#167623

On Mon 09 May 2016 at 16:10:51 +0200, tomas@tuxteam.de wrote:

> On Mon, May 09, 2016 at 02:57:48PM +0100, Brian wrote:
> > On Mon 09 May 2016 at 15:33:17 +0200, tomas@tuxteam.de wrote:
> > 
> > > On Mon, May 09, 2016 at 02:09:45PM +0100, Brian wrote:
> > > > On Mon 09 May 2016 at 14:50:06 +0200, tomas@tuxteam.de wrote:
> > > 
> > > [...]
> > > 
> > > > > Of course you gotta do that as root, either by sudo magic or whatever.
> > > > 
> > > > Not necessarily; udisksctl (install udisks2) and udevil are two programs
> > > > which will do this for a user. 
> > > 
> > > To each his/her own :-)
> > 
> > Not if he/she does not have root access on the machine. :)
> 
> If he/she successfully dumped a file to /, then he/she has.

Got it! If he/she has root privileges they must be used. None of this
namby-pamby user stuff. :)

[toc] | [prev] | [next] | [standalone]

#167625

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, May 09, 2016 at 03:53:32PM +0100, Brian wrote:

[...]

> Got it! If he/she has root privileges they must be used. None of this
> namby-pamby user stuff. :)

We're on our second iteration of that. We'll bore ourselves to death.
Let's just agree to differ, OK?

- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlcwqoAACgkQBcgs9XrR2kaqLQCffTBKAzNOldUozZq4oF6ZorTK
4h8Anj/02D/ai+J0c4KXMsYRae/zeQaH
=sC1+
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#167633

On Mon 09 May 2016 at 17:19:28 +0200, tomas@tuxteam.de wrote:

> On Mon, May 09, 2016 at 03:53:32PM +0100, Brian wrote:
> 
> [...]
> 
> > Got it! If he/she has root privileges they must be used. None of this
> > namby-pamby user stuff. :)
> 
> We're on our second iteration of that. We'll bore ourselves to death.

Second, third and fourth reinterations of advice on good practice are
hopefully not wasted on -user.

> Let's just agree to differ, OK?

Indeed.

[toc] | [prev] | [next] | [standalone]

#167599

Haines Brown <haines <at> histomat.net> writes:

> 
> Every once in a while I get a filled root partition, and the reason in
> 
> # ncdu -rx /
>   425.5MiB [##########] sde1
>   198.3MiB [####      ] /lib
>   193.8MiB [####      ] /mnt
>   ...

If 'ncdu -x' means 'do not cross filesystem boundaries' then sde should
be a file, not another partition. Besides, a partition sde1 would not
fill up your root partition, as long as /dev/sde1 is not mounted as your
root partition.

> 
> $ mount | grep sde
> [nothing]

As sde1 is just a file, not a filesystem, it should no be listed under
mounts.

So, most likely some program wanted to write to /dev/sde1 but instead
wrote to /sde1 which was then filled up with data and now uses all the 
free space of your root partition. If you don't know, how it was generated,
just make a backup on a usb usb-stick (in case you remember what it
was good for, just after erasing it) and delete the file.

Juergen

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web