[systemd-devel] lost journal persistence

[Chris Murphy]

On May 15, 2014, at 3:58 PM, Lennart Poettering <lennart at poettering.net> wrote:

> On Sat, 10.05.14 18:02, Chris Murphy (lists at colorremedies.com) wrote:
> 
>> So I thought maybe the flush is happening to /var before var subvolume is mounted there, but that's not the case; the reason why it's not empty is due to dhclient always creating one folder prior to var subvolume mounting at /var.
>> 
>> /var/lib/dhclient
> 
> Hmm, this looks like a bug. Is dhclient invoked before /var is mounted?

Seems not to be, as the first reported instance of dhclient is afterward and /var already has something in it. Maybe NetworkManger creates it?

[    2.839950] f20v.localdomain systemd[1]: Mounting /var...
[    2.840310] f20v.localdomain systemd[1]: var.mount: Directory /var to mount over is not empty, mounting anyway.
[    2.840589] f20v.localdomain systemd[1]: Mounting /home...
[    2.848319] f20v.localdomain systemd[1]: Mounting /boot...
[    2.848386] f20v.localdomain kernel: BTRFS: device label f20 devid 1 transid 3961 /dev/sda2
[    2.849926] f20v.localdomain kernel: BTRFS: device label f20 devid 1 transid 3961 /dev/sda2
[    2.854250] f20v.localdomain kernel: BTRFS: device label f20 devid 1 transid 3961 /dev/sda2
[    2.875834] f20v.localdomain systemd[1]: Mounted /home.
[    2.876293] f20v.localdomain systemd[1]: Mounted /var.

[    3.745285] f20v.localdomain NetworkManager[393]: <info> dhclient started with pid 477



> If so, it really shouldn't be writing to /var... What component invokes
> dhclient this early?


The time stamp of /var/lib is 17:03, which matches up with startup time, not prior shutdown time. So it looks created at startup time.

Seems crude but I could figure out how to set an selinux label on the wrong /var to prevent anything from creating things there, and see what explodes?



Chris Murphy