before i even =touch= my server again....

[Polytropon]

On Wed, 23 Jun 2010 13:03:03 -0500, Kirk Strauser <kirk at strauser.com> wrote:
> On 06/23/10 11:35, Polytropon wrote:
> > Of course, all write attempts to /var will then fail.
> 
> Or even worse: they'll succeeded. And then when you re-mount /var, 
> you'll lose access to all the files you've written in the mean time.

True, an important advice. In case /var is not mounted, the
/var directory on / will be just a "plain directory". Depending
on program behaviour, it is possible that logging programs
create a new file when missing a file to append. In this case,
/ will fill with such files in /var. It's important to remove
them prior to re-mounting /var. It is possible to move them,
e. g. to /tmp, and immediately append them to the correct files
after re-mounting /var. But if (small) data loss is acceptable
for the time needed to fix /var, it is an option.

Another possibility is - but I never tried it - to force fsck
to check a mounted partition that is in use.

	# fsck -yf /var

This may (!) cause other forms of damage, allthough fsck should
be able to correct most usual problems.

It's a good approach to stop as many services as possible that
could want to write to /var, and restart them after /var is clean
and mounted again.




-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...