linux-ext4 - Re: Need help to understand Ext4 message in /var/log/message file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAG-6nk-ntm56DANOJJKGq9cORYT+3XiL4Wjz-BnFs1XrKc5RXA@mail.gmail.com>
Date:   Sat, 25 Apr 2020 11:09:17 +0530
From:   Alok Jain <jain.alok103@...il.com>
To:     Andreas Dilger <adilger@...ger.ca>
Cc:     linux-ext4@...r.kernel.org, tytso@....edu
Subject: Re: Need help to understand Ext4 message in /var/log/message file

Thanks Andreas it was helpful

So looks like new device has bad journal, is there a way to find if
device of ext4 FS has bad journal?

One question If I generate new UUID on device and it got corrupted
will it roll back to old UUID i.e. does it keeps info about previous
metdata (superblock)?

Thanks,
Alok

On Sat, Apr 25, 2020 at 3:13 AM Andreas Dilger <adilger@...ger.ca> wrote:
>
> On Apr 24, 2020, at 12:56 PM, Alok Jain <jain.alok103@...il.com> wrote:
> >
> > Hi Guys,
> >
> > I need an help to understand the following messages printed in
> > /var/log/message file
> >
> > Apr 20 17:42:44 mylinux audispd: node=mylinux type=EXECVE
> > msg=audit(1587404564.745:5901346): argc=4 a0="mount" a1="-v"
> > a2="UUID=b1d54239-2b18-44b3-a4bf-5e0ca32b8f78" a3="/tmp/aj/m1"
> > Apr 20 17:42:45 mylinux kernel: [4633324.069180] EXT4-fs (sde1):
> > recovery complete
> > Apr 20 17:42:45 mylinux kernel: [4633324.070157] EXT4-fs (sde1):
> > mounted filesystem with ordered data mode. Opts: (null)
> >
> >
> > Actualy one of the iSCSI device is mounted to /tmp/aj/m1 with UUID
> > (U1) I unmounted this device and mounted new device (UUID
> > b1d54239-2b18-44b3-a4bf-5e0ca32b8f78) after mount I see the UUID of
> > newly mounted device changed to U1 and new device got corrupted. I ran
> > fsck to fix the device but UUID was changed to U1.
>
> It sounds like the iSCSI device is not flushing the block device
> cache between unmounting the old filesystem and mounting the new one?
>
> The new filesystem has a dirty journal, and when it is replayed it
> reads a stale superblock from the old filesystem and overwrites the
> new filesystem.
>
> Cheers, Andreas
>
>
>
>
>