3
Aldar
3y

Anyone has any idea how to debug occasional (Severa times a day) where one of our servers decides to mount a second copy of the same NFS? It triggers our monitoring system thinking there was a change to the mounts of the system, and I was able to verify through the mounts command, that it indeed had the same NFS mount mounted twice, with exactly the same parameters.

Is there a debug interface of some sort to see what initiated that mount? Or any tool to help me track it down? I've been stuck with this mysterious issue for a while now (As it's not really a priority, it doesn't break anything, but it bugs me and I wanna know)

Comments
  • 2
    If the question is why and by whom, audit might be worth a try:

    https://wiki.archlinux.org/title/...

    You can Google examples, auditctl -D removes all rules if I remember correctly and auditctl -a always,exit -S mount,umount2 -k mount_umount should be for mounts.

    Don't use auditd lightly. :) Create a ruleset or you'll be spammed to death.
  • 1
    @IntrusionCM Oh, I actually remember coming across the auditing framework once in the past already. It is super useful to me right now.

    Thanks!
  • 0
    That's NFS in a nutshell.

    It's a POS. Use something else.
Add Comment