file locked

[mans]

hi to all,

i'm a Mageia 3 user and i'm facing with a issue that i can't solve.
The server was working for months and last day i've tried to make a cron settings
for suprise the system was reported an error, so i started investigation about it and i found
that the crontab in the /usr/bin/ seem locked ie do not accept any command same as root
the only command accept is copy. thinking that would be a corrupted file i copied to another fs
and it seem run properly but into your fs i can't do nothing. I forced a fsck on initialization but
no errors is reported.
Some one was faced with problem like that.

Best Regards;

mans

[doktor5000]

Could you at least show the output of some command that doesn't work, or an error message? I fail to understand what the problem is.

[mans]

Hi Doktor, thanks by reply.

Well for any command i get permission not allowed
see

crontab error

crontab.png (13.05 KiB) Viewed 1150 times

I made fsck of entire fs and nothing was reported.
I don't understand this too!!

Tks;

Best Regards;

[doktor5000]

Can you please show the output as root of

Code: Select all

rpm -V cronie
stat /usr/bin/crontab
ls -li /usr/bin/crontab
lsattr /usr/bin/crontab
fuser -uv /usr/bin/crontab
df /usr/bin/crontab

and df on the filesystem where /usr/bin/crontab is inside (shown by last command)

[mans]

Hi Doktor, thanks by your time.

Code: Select all

[root@svr ~]# rpm -V cronie
S.5....T.  c /etc/sysconfig/crond
.M.......    /usr/bin/crontab
.M.......    /var/spool/cron
[root@svr ~]#
[root@svr ~]# stat /usr/bin/crontab
  File: â/usr/bin/crontabâ

Device: 816h/2070d      Inode: 787077      Links: 1
Access: (0000/----------)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2014-10-16 05:04:53.297265649 -0300
Modify: 2013-03-26 20:02:25.000000000 -0300
Change: 2014-10-12 00:55:28.886863206 -0300
 Birth: -
[root@svr ~]#
[root@svr ~]# ls -li /usr/bin/crontab
787077 ---------- 1 root root 46000 Mar 26  2013 /usr/bin/crontab
[root@svr ~]#
[root@svr ~]# lsattr /usr/bin/crontab
s---ia-------e-- /usr/bin/crontab
[root@svr ~]#
[root@svr ~]# fuser -uv /usr/bin/crontab
[root@svr ~]#
[root@svr ~]# df /usr/bin/crontab
Sist. Arq.      Tam. Usado Disp. Uso% Montado em
/dev/sdb6        21G  2,0G   18G  11% /usr
[root@svr ~]# df /dev/sdb6
Sist. Arq.      Tam. Usado Disp. Uso% Montado em
/dev/sdb6        21G  2,0G   18G  11% /var/lib/named/usr/lib64/openssl
[root@svr ~]# df /dev/sdb6/usr
df: â/dev/sdb6/usrâ
                   [root@svr ~]#
[root@svr ~]#
[root@svr ~]#
[root@svr ~]# df
Sist. Arq.      Tam. Usado Disp. Uso% Montado em
rootfs           21G  191M   19G   1% /
devtmpfs        460M     0  460M   0% /dev
tmpfs           467M     0  467M   0% /dev/shm
tmpfs           467M  420K  466M   1% /run
/dev/sdb1        21G  191M   19G   1% /
/dev/sdb6        21G  2,0G   18G  11% /usr
tmpfs           467M     0  467M   0% /sys/fs/cgroup
/dev/sda1        15G   15G     0 100% /bkp
/dev/sdb11       76G  107M   76G   1% /windows
/dev/sdb7        96G  5,0G   87G   6% /var
/dev/sdb10       96G   11G   81G  12% /docs
/dev/sdb8       146G   33G  113G  23% /home
/dev/sdb9       3,8G  8,2M  3,6G   1% /tmp
/dev/sdb1        21G  191M   19G   1% /var/lib/named/etc/rndc.key
/dev/sdb1        21G  191M   19G   1% /var/lib/named/etc/named.iscdlv.key
/dev/sdb6        21G  2,0G   18G  11% /var/lib/named/usr/lib64/bind
/dev/sdb6        21G  2,0G   18G  11% /var/lib/named/usr/lib64/openssl
/dev/sdb7        96G  5,0G   87G   6% /var/lib/named/var/named

well, by now i found a middle ground for the problem i done a copy of crontab to crontab2 like this i can edite the cron events.
Before posting this topic I did an extensive search on the net and found various topics that point to similar but all attempts failed.
If i done some thing wrong above, tell me and i correct.

Best Regards,

[doktor5000]

[root@svr ~]# rpm -V cronie
S.5....T. c /etc/sysconfig/crond
.M....... /usr/bin/crontab
.M....... /var/spool/cron

See below, you should probably try

Code: Select all

urpmi --replacepkgs --replacefiles cronie

as a last measure but if the file cannot be removed it would be interesting to see what happens

[root@svr ~]# lsattr /usr/bin/crontab
s---ia-------e-- /usr/bin/crontab

This might be the problem. immutable and append flags are set. And also "s" attribute, which I've honestly never seen in use before.
So

Code: Select all

chattr -sia /usr/bin/crontab

may help, but as you tried -i before already it seems pretty borked.

[mans]

See below, you should probably try Code: Select all
urpmi --replacepkgs --replacefiles cronie
as a last measure but if the file cannot be removed it would be interesting to see what happens

I've done before post, i removed the package and re-installed but the crontab can't be removed or updated.

mans wrote:
[root@svr ~]# lsattr /usr/bin/crontab
s---ia-------e-- /usr/bin/crontab

This might be the problem. immutable and append flags are set. And also "s" attribute, which I've honestly never seen in use before.
So Code: Select all
chattr -sia /usr/bin/crontab
may help, but as you tried -i before already it seems pretty borked.

Yes, the chattr, can not be performed.
without doubt is this the problem.

by now the cron seem work normal, crontab2 is doing the jobs normally i don't see any error log pointing to cron.
I'm intrigued with this!!
well, i'm not expert and from your experience what you could tell, has possibility of the system goes into abnormal operation in this condition?

After i posted i done a search in the server logs and found a issue reported by kernel related with shell segmentation fault
I'm not sure if it is here that we can post and if has some thing related but anyway is:

Oct 17 06:42:02 svr kernel: [139238.105327] sh[27878]: segfault at 0 ip 0000000000438487 sp 00007fffc2668010 error 4 in bash[400000+b9000]

this log represents days from 15-17.

Best Regards;

[jiml8]

If I were you, I would be taking a good, hard look at my drive. When nothing you do makes a file go away, it usually indicates a problem in the filesystem or the drive.

You've run fsck, though you might try that again with the -f flag to see what you find. This would cause me to be testing the hard drive media or, if it is an SSD, I would be wondering about a bit-level failure in the drive.

[doktor5000]

If I were you, I would be taking a good, hard look at my drive. When nothing you do makes a file go away, it usually indicates a problem in the filesystem or the drive.

If it's not an harddrive problem, the system could also be corrupted by some attacker ...

[mans]

You've run fsck, though you might try that again with the -f flag to see what you find.

I've done it before. nothing reported.

If it's not an harddrive problem, the system could also be corrupted by some attacker ...

excluding the filesystem, you would an idea what type of attack would do that??