1

Is there a way to find out what is trying to mount this file?

Jul 13 14:27:24 myhost automount[13527]: lookup(file): lookup for tmp_dir failed

Something is looking for "tmp_dir", and I've grepped a bunch of places but cannot find what script, program, etc... is looking for the file/dir and is causing automount to try and mount it up.

I see there are entries in /proc/mounts for tmp_dir, but looks like I cannot remove them since /proc/mounts is read-only (probably for good reason). Thoughts?

For a little background, we recently took down a file share that was called tmp_dir, and I think a programmer still has something pointing to tmp_dir, but he claims he cleaned everything up. I'm thinking maybe we did not umount tmp_dir properly before taking down the share, and autofs is still attempting to load it. The OS is SLES 11 SP1.

Gilles 'SO- stop being evil'
  • 829,060
Banjer
  • 2,920

1 Answers1

1

Here are a couple of ways to monitor accesses to particular files. I'm not completely sure how they'll interact with an automounter, but they probably will work.

  • Put a LoggedFS filesystem on the automount directory (/amnt or whatever), and configure it to look out for /amnt/tmp_dir. Start from the provided configuration file example and tweak the include/exclude rules according to this guide.

  • Get the Linux audit subsystem utilities (on any recent distribution, this should just be a matter of installing a package), and make the kernel look out for this file:

    auditctl -a exit,always -w /amnt/tmp_dir

See also Determine which process is creating a file; my answer there has more explanations on LoggedFS and auditd.

Community
  • 1
Gilles 'SO- stop being evil'
  • 829,060
  • Thanks, that is helpful. Just doing lsof on the particular directory provided some clues. lsof gave a warning saying it can't stat() the directory. Looks like /proc/mounts has some stale entries. How do I refresh /proc/mounts? restart nfs? I'll need to try that during off-hours as I imagine it would wreak some havoc on anyone working off nfs mounted directories. – Banjer Jul 15 '11 at 13:33
  • @Banjer There's no such thing as “refreshing” /proc/mounts: it's the real-time information straight from the kernel. – Gilles 'SO- stop being evil' Jul 15 '11 at 14:49
  • I rebooted the server and it "cleared" those entries in /proc/mounts, so I no longer see failed automount lookups for tmp_dir in my logs. I'm not sure why /proc/mounts had those stale entries, but I'm guessing we did not properly unmount the folder before taking the share down on the nfs server. Those fs auditing tools you pointed me too will most likely come in handy for future issues. – Banjer Jul 18 '11 at 14:24