Mageia forum

Some process occasionally causes the HDD connected via USB 3.0 to spin-up.
The drive is normally unmounted and mounted only for off-line backup needs.
I wanted to investigate the situation using auditd, but it turns out that it is no longer supported by the 6.5 kernel.

Code: Select all

[root@Piotr ~]# ls -la /dev/sdb
brw-rw---- 1 root disk 8, 16 gru 11 08:01 /dev/sdb
[root@Piotr ~]# auditctl -a always,exit -F devmajor=8 -F devminor=16
Error - audit support not in kernel
Cannot open netlink audit socket

What tool could I use instead of the command above?

Some more details about your setup would be helpful. Is the external HDD listed in your fstab or do you mount it by means of your desktop environment ?
Also, when the HDD spins up, what process do you see when you run iotop ? And how often do those occur, once per day, more or less often ... ?

My guess would either by the daily msec scans or some thumbnailer.
As we don't have audit support enabled, you could leave something like fatrace running and watch the mount for the external HDD.

HDD is listed in fstab (user mountable) and mounted from Bash backup script.
iotop does note show any proces with that dev.
IT occurs 2-3 times per hour, unregulary
For test I disabled msec but it still spin up

I now requested an update of auditd, 3.1.2 say it have updated tables for 6.5 kernels.
Just guessing that may be the problem.
Would be great if you could test and feedback that update in the bug.
https://bugs.mageia.org/show_bug.cgi?id=32616

Why do you suggest an audit update is needed? OP probably doesn't even have audit support enabled (kernel option audit=1) as we neither have it installed nor enabled by default.

Perhaps the device is performing a SMART test. If you check the SMART properties, it will tell you when the last SMART test was performed.

I think its possible because disk is pooled every 30 min by default. So I try to disable checking of this disk in smartd.conf.

johnpenguin wrote:Perhaps the device is performing a SMART test. If you check the SMART properties, it will tell you when the last SMART test was performed.

Yep, its right solution!

auditd, but it turns out that it is no longer supported by the 6.5 kernel.

If you want to try again, and/or help QA auditd, a new version is in testing.