Need help to understand Ext4 message in /var/log/message file

Need help to understand Ext4 message in /var/log/message file

[Alok Jain]

Hi Guys,

I need an help to understand the following messages printed in
/var/log/message file

Apr 20 17:42:44 mylinux audispd: node=mylinux type=EXECVE
msg=audit(1587404564.745:5901346): argc=4 a0="mount" a1="-v"
a2="UUID=b1d54239-2b18-44b3-a4bf-5e0ca32b8f78" a3="/tmp/aj/m1"
Apr 20 17:42:45 mylinux kernel: [4633324.069180] EXT4-fs (sde1):
recovery complete
Apr 20 17:42:45 mylinux kernel: [4633324.070157] EXT4-fs (sde1):
mounted filesystem with ordered data mode. Opts: (null)


Actualy one of the iSCSI device is mounted to /tmp/aj/m1 with UUID
(U1) I unmounted this device and mounted new device (UUID
b1d54239-2b18-44b3-a4bf-5e0ca32b8f78) after mount I see the UUID of
newly mounted device changed to U1 and new device got corrupted. I ran
fsck to fix the device but UUID was changed to U1.

Any help is greatly appreciated.

Thanks,
Alok

Re: Need help to understand Ext4 message in /var/log/message file

[Andreas Dilger]

[-- Attachment #1: Type: text/plain, Size: 1222 bytes --]

On Apr 24, 2020, at 12:56 PM, Alok Jain <jain.alok103@gmail.com> wrote:
> 
> Hi Guys,
> 
> I need an help to understand the following messages printed in
> /var/log/message file
> 
> Apr 20 17:42:44 mylinux audispd: node=mylinux type=EXECVE
> msg=audit(1587404564.745:5901346): argc=4 a0="mount" a1="-v"
> a2="UUID=b1d54239-2b18-44b3-a4bf-5e0ca32b8f78" a3="/tmp/aj/m1"
> Apr 20 17:42:45 mylinux kernel: [4633324.069180] EXT4-fs (sde1):
> recovery complete
> Apr 20 17:42:45 mylinux kernel: [4633324.070157] EXT4-fs (sde1):
> mounted filesystem with ordered data mode. Opts: (null)
> 
> 
> Actualy one of the iSCSI device is mounted to /tmp/aj/m1 with UUID
> (U1) I unmounted this device and mounted new device (UUID
> b1d54239-2b18-44b3-a4bf-5e0ca32b8f78) after mount I see the UUID of
> newly mounted device changed to U1 and new device got corrupted. I ran
> fsck to fix the device but UUID was changed to U1.

It sounds like the iSCSI device is not flushing the block device
cache between unmounting the old filesystem and mounting the new one?

The new filesystem has a dirty journal, and when it is replayed it
reads a stale superblock from the old filesystem and overwrites the
new filesystem.

Cheers, Andreas






[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 873 bytes --]

Re: Need help to understand Ext4 message in /var/log/message file

[Alok Jain]

Thanks Andreas it was helpful

So looks like new device has bad journal, is there a way to find if
device of ext4 FS has bad journal?

One question If I generate new UUID on device and it got corrupted
will it roll back to old UUID i.e. does it keeps info about previous
metdata (superblock)?

Thanks,
Alok

On Sat, Apr 25, 2020 at 3:13 AM Andreas Dilger <adilger@dilger.ca> wrote:
>
> On Apr 24, 2020, at 12:56 PM, Alok Jain <jain.alok103@gmail.com> wrote:
> >
> > Hi Guys,
> >
> > I need an help to understand the following messages printed in
> > /var/log/message file
> >
> > Apr 20 17:42:44 mylinux audispd: node=mylinux type=EXECVE
> > msg=audit(1587404564.745:5901346): argc=4 a0="mount" a1="-v"
> > a2="UUID=b1d54239-2b18-44b3-a4bf-5e0ca32b8f78" a3="/tmp/aj/m1"
> > Apr 20 17:42:45 mylinux kernel: [4633324.069180] EXT4-fs (sde1):
> > recovery complete
> > Apr 20 17:42:45 mylinux kernel: [4633324.070157] EXT4-fs (sde1):
> > mounted filesystem with ordered data mode. Opts: (null)
> >
> >
> > Actualy one of the iSCSI device is mounted to /tmp/aj/m1 with UUID
> > (U1) I unmounted this device and mounted new device (UUID
> > b1d54239-2b18-44b3-a4bf-5e0ca32b8f78) after mount I see the UUID of
> > newly mounted device changed to U1 and new device got corrupted. I ran
> > fsck to fix the device but UUID was changed to U1.
>
> It sounds like the iSCSI device is not flushing the block device
> cache between unmounting the old filesystem and mounting the new one?
>
> The new filesystem has a dirty journal, and when it is replayed it
> reads a stale superblock from the old filesystem and overwrites the
> new filesystem.
>
> Cheers, Andreas
>
>
>
>
>