Paul Smith wrote:
>
> On 1/20/07, Steve Siegfried <sos@xxxxxxxx> wrote:
> > > > > I am getting these strange messages:
> > > > >
> > > > > Jan 20 01:22:22 localhost kernel: end_request: I/O error, dev fd0, sector 0
> > > > > Jan 20 01:22:22 localhost kernel: end_request: I/O error, dev fd0, sector 0
> > > > > Jan 20 01:22:22 localhost kernel: floppy0: disk absent or changed
> > > > > during operation
> > > > > Jan 20 01:22:22 localhost kernel: end_request: I/O error, dev fd0, sector 0
> > > > > Jan 20 01:22:22 localhost kernel: end_request: I/O error, dev fd0, sector 0
> > > > > Jan 20 01:22:22 localhost kernel: floppy0: disk absent or changed
> > > > > during operation
> > > > >
> > > > > It surprises me, as I do not have any floppy disk inserted.
> > > >
> > > > If, as root, you do something like:
> > > > # cp /dev/fd0 /tmp/foo
> > > > without a floppy inserted, you'll see a single kernel messages in your logs:
> > > > > <DATE/TIME> localhost kernel: end_request: I/O error, dev fd0, sector 0
> > > >
> > > > So offhand, I'd say some program on your box is trying to read or write to the
> > > > floppy device.
> > > >
> > > > If you have the psacct rpm (the process accounting package) installed, as root
> > > > you should be able to do:
> > > > # lastcomm | grep "Jan 20 01:2"
> > > > to see the names of what programs were started between 01:20:20 and 01:29:59.
> > > > Somewhere in that output, probably around 01:22:20 or so, you should find
> > > > the offending program.
> > >
> > > Thanks, Steve, but lastcomm returns nothing:
> > >
> > > # lastcomm
> > > #
> >
> > Sounds like you've got psacct installed, but aren't running it. Try:
> > $ su
> > # /etc/rc.d/init.d/psacct status
> > If it says "enabled" or "started" or "active" or some such, you're
> > running it, but lastcomm isn't reading the right file. In that case,
> > look at /etc/rc.d/init.d/psacct to see what file is being used (it'll
> > be the first parameter to /sbin/accton) and hand the name of that file
> > to lastcomm.
> >
> > However, it it says "disabled" or "stopped" or some such, you need to
> > do:
> > # /etc/rc.d/init.d/psacct start
> > and then wait for another occurance of the "end_request: I/O error"
> > in your logs. After seeing that occurance, run the lastcomm pipe.
> >
> > ... and just to be safe, "rpm -V psacct" should run cleanly in either
> > case, too.
>
> You are right, Steve:
>
> # /etc/rc.d/init.d/psacct status
> Process accounting is disabled.
> #
>
> I have now to wait for another occurrence of the "end_request: I/O
> error" in your logs.
>
> Paul
>
Oh yeah... I forgot to add that once you get the list of suspects
narrowed down with that "lastcomm | grep" pipe, you'll probably
need ftrace, too.
Grep ftrace's output from any particular suspect for "fd0", i.e.:
# ftrace dd if=/dev/fd0 of=/tmp/foo | grep fd0
Output from the offending program run with ftrace should show you
something like:
> 22617.22617 <SYSCALL> open ("/dev/fd0",32768,0)22617.22617 = -1 ERRNO=6
When you see some sort of open on /dev/fd0, you've found your culprit.
-S
