linux-kernel - very very strange simultaneous RAID resync on sep 2, 01:06 CEST (+2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 03 Sep 2007 09:56:10 +0200
From:	Xavier Bestel <xavier.bestel@...e.fr>
To:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: very very strange simultaneous RAID resync on sep 2, 01:06 CEST
	(+2)

Hi,

I have a server running with RAID5 disks, under debian/stable, kernel
2.6.18-5-686. Yesterday the RAID resync'd for no apparent reason,
without even mdamd sending a mail to warn about that:

Sep  2 01:06:01 awak kernel: md: syncing RAID array md0
Sep  2 01:06:01 awak kernel: md: minimum _guaranteed_ reconstruction speed: 1000 KB/sec/disc.
Sep  2 01:06:01 awak kernel: md: using maximum available idle IO bandwidth (but not more than 200000 KB/sec) for reconstruction.
Sep  2 01:06:01 awak kernel: md: using 128k window, over a total of 48064 blocks.
Sep  2 01:06:01 awak kernel: md: delaying resync of md1 until md0 has finished resync (they share one or more physical units)
Sep  2 01:06:01 awak kernel: md: delaying resync of md2 until md0 has finished resync (they share one or more physical units)
Sep  2 01:06:05 awak kernel: md: md0: sync done.
Sep  2 01:06:05 awak kernel: RAID1 conf printout:
Sep  2 01:06:05 awak kernel:  --- wd:3 rd:3
Sep  2 01:06:05 awak kernel:  disk 0, wo:0, o:1, dev:hda1
Sep  2 01:06:05 awak kernel:  disk 1, wo:0, o:1, dev:hde1
Sep  2 01:06:05 awak kernel:  disk 2, wo:0, o:1, dev:hdc1
Sep  2 01:06:05 awak kernel: md: delaying resync of md2 until md1 has finished resync (they share one or more physical units)
Sep  2 01:06:05 awak kernel: md: syncing RAID array md1
Sep  2 01:06:05 awak kernel: md: minimum _guaranteed_ reconstruction speed: 1000 KB/sec/disc.
Sep  2 01:06:05 awak kernel: md: using maximum available idle IO bandwidth (but not more than 200000 KB/sec) for reconstruction.
Sep  2 01:06:05 awak kernel: md: using 128k window, over a total of 10000384 blocks.

In itself, this event is already strange. But what's even stranger is
that another guy had the same resync exactely at the same time (all
times are CEST (+0200)):

Sep  2 01:06:01 in22 kernel: md: syncing RAID array md0
Sep  2 01:06:01 in22 kernel: md: minimum _guaranteed_ reconstruction speed: 1000 KB/sec/disc.
Sep  2 01:06:01 in22 kernel: md: using maximum available idle IO bandwidth (but not more than 200000 KB/sec) for reconstruction.
Sep  2 01:06:01 in22 kernel: md: using 128k window, over a total of 1003904 blocks.
Sep  2 01:06:01 in22 kernel: md: delaying resync of md1 until md0 has finished resync (they share one or more physical units)
Sep  2 01:06:01 in22 kernel: md: delaying resync of md2 until md0 has finished resync (they share one or more physical units)
Sep  2 01:06:01 in22 kernel: md: delaying resync of md1 until md0 has finished resync (they share one or more physical units)
Sep  2 01:06:01 in22 kernel: md: delaying resync of md3 until md0 has finished resync (they share one or more physical units)
Sep  2 01:06:01 in22 kernel: md: delaying resync of md1 until md0 has finished resync (they share one or more physical units)
Sep  2 01:06:01 in22 kernel: md: delaying resync of md2 until md3 has finished resync (they share one or more physical units)
Sep  2 01:06:39 in22 kernel: md: md0: sync done.
Sep  2 01:06:39 in22 kernel: md: delaying resync of md2 until md3 has finished resync (they share one or more physical units)
Sep  2 01:06:39 in22 kernel: md: syncing RAID array md1
Sep  2 01:06:39 in22 kernel: md: minimum _guaranteed_ reconstruction speed: 1000 KB/sec/disc.
Sep  2 01:06:39 in22 kernel: md: using maximum available idle IO bandwidth (but not more than 200000 KB/sec) for reconstruction.
Sep  2 01:06:39 in22 kernel: md: using 128k window, over a total of 7004224 blocks.
Sep  2 01:06:39 in22 kernel: md: delaying resync of md3 until md1 has finished resync (they share one or more physical units)
Sep  2 01:06:39 in22 kernel: RAID1 conf printout:
Sep  2 01:06:39 in22 kernel:  --- wd:2 rd:2
Sep  2 01:06:39 in22 kernel:  disk 0, wo:0, o:1, dev:hda1
Sep  2 01:06:39 in22 kernel:  disk 1, wo:0, o:1, dev:hdb1
(reboot)

I'm still gathering informations (no idea what his disks are, etc.), but
does anyone have the same problem ? Does anyone know where it can come
from (debian trouble, md bug, drive firmware problem, rootkit, ..) and
how I can pinpoint that ?

Thanks,
	Xav

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/