Strange Files Created, FSCK problems: how to deal without single user mode (/unmounting disc)?

[Bill Moran]

"Bigbrother" <bigbrother at bonbon.net> wrote:
> 
> Dear all,
> 
>  Today I found out (due to my backup process failure) that 
>  some strange files were created on a users dir.
> 
>  Specifically:
> 
>  --wx--s-wx  16217 1062905872  1311669378    1061708166 Jan  1  1970
> .irssi
>  b---rwx--x  16240 root        wheel       174, 0x3f590067 Jan  1  1970
> .mc
> 
> These entries were supposed to be directories, but somehow they changed
> to something else.
> 
> I tried to remove them:
> 
> rm .irssi
> override -wx--s-wx  1062905872/1311669378 sappnd,arch,schg,uappnd,opaque
> for .irssi? y
> rm: .irssi: Operation not permitted
> 
>  rm .mc
> override ---rwx--x  root/wheel schg,uappnd,nodump for .mc? y
> rm: .mc: Operation not permitted

You might want to try removing some of those flags ... see 'man chflags'

>  I fscked the disc (note that his is an active disc with many users) and
> the report is located at the end of this email. Because 
>  the disc is read-write active changed are not written on the disc.
> 
> 
>  My questions:
> 
>  1) Have you got any clue how a healthy IDE disc can cause and corrupt
> files on the file system?

Lots of ways.  Misc hardware glitches would be the most common.  Folks
with admin rights doing things they shouldn't also occurs.  I've seen NFS
leave files in weird states on occasion, but I've never been able to
reproduce the problem.

>  2) How can I fix the problem WITHOUT rebooting or without UNMOUNTING
> the discs?

a) You can't unless you're using 5.x and can run background fsck.
b) Since you ran fsck while the disk was mounted, those might not even
   be real errors, but just inconsistencies due to the filesystem being
   in use during the fsck.

> If I fsck and
>      instruct to actually fix the errors, will they be fixed, or it
> might crash corrupt the whole file system?

Don't run fsck on a mounted filesystem.  (Exception, you can run background
fsck).  If you run fsck on a mounted filesystem, all bets are off.

>  3) How serious is this problem? Should I start worrying, even though
> nothing else strange exist?

Last time I had a problem like this, I unmounted the fs, took 15 minutes to
fsck it, remounted it and went back to work ... I'm still using that
filesystem today (many months and many gigs later).  YMMV.

-- 
Bill Moran
Potential Technologies
http://www.potentialtech.com