dgladden@wsmr08.ARPA (Doug Gladden CD-SP) (05/18/85)
Recently, we've been plagued with our nightly fsck reporting two inodes claiming to own the same duplicate block on the root file system on several of our BBN C70 System V machines with 167M Ampex drives. /etc/wtmp or even worse /etc/passwd are often involved, resulting in a lot of effort in cleaning up the filesystem and recreating the files. Dups rarely occur on /usr or /tmp and seem to appear on / during peak periods. Can an application program or broken utility like passwd create this mess or must this result from a kernel or hardware failure? Thanks in advance for any help you can offer.
gwyn@brl-tgr.ARPA (Doug Gwyn <gwyn>) (05/19/85)
Nothing a user-mode process can do can cause a data block to be shared between two inodes. (Except that a privileged process can write on the raw disk and mess the filesystem structure up!) This has to be a kernel or hardware problem.
sienkiew@UDEL-DEWEY.ARPA (05/20/85)
>Can an application program or broken utility like passwd create this mess or >must this result from a kernel or hardware failure? Application programs that directly play with the disk can do this. This is limited to things like clri, icheck, dcheck, & fsck. passwd should not be able to do it. I hesitate to say cannot, since I've seen what weird things some unixes do*, but there should be no way for a normal application to cause this. >Dups rarely occur on /usr or /tmp and seem to appear on / during peak periods. Do you run the fscks during peak periods too? If you do, you may be seeing totally garbaged data, since the file system will be changing faster than fsck could follow (if it even tried...). I've noticed weird things happen to unix file systems under these conditions: 1- somebody took down the system without a sync. Or they cause a panic. Either way, everything is automatically suspect. 2- I only work on small machines, so I don't always remember to go to single user mode before checking the fs. Then uucp logs in and I get a dozen diagnostics. (This cleared up a lot when I quit doing this.) What more can you tell us about your systems, in particular, what do you have that isn't 100% vanilla? Mark. --- * i.e. HPUX csh puts your terminal in cbreak so it can fake newcrt without putting it in the kernel. I kid you not.