On Thu, Dec 31, 2020 at 11:09 AM Greg Woods <greg(a)gregandeva.net> wrote:
I suppose I should provide more info. /pub is a place where I store a bunch of stuff. In
particular there are our photo and music collections, and rsync'ed Fedora repos (I
rsync F32 and F33 repos once a day, then I use the local repo to perform updates on my 6
Fedora systems).
The problem here is that, by the time I see one of these entries and investigate, the PID
is for a process that is long gone, and I'm not getting any useful info about what
command is triggering this.
I'd guess that it's related to polling for repo differences.
Again, process 253560 is long gone, but at least I know that this
automount was triggered by a dnf command. When the command is "PT3122", then I
have no clue what triggered this automount.
No idea.
I think for this it's something of a heavy hammer, but you could try
fatrace to see what's doing what, e.g.
firefox(43214): W
/mnt/home/chris/.mozilla/firefox/sfgorfus.default-release/storage/default/moz-extension+++cbf54e9c-1792-49aa-8511-5756bf926071^userContextId=4294967295/idb/3647222921wleabcEoxlt-eengsairo.sqlite-wal
Process name and PID, write, path to file. You might want to cd /pub
and run this with --current-mount option. Do that in a tmux pane and
just walk away from it? I have seen it give up if there's too many
reads/writes, but I don't know the parameters of when or why it stops.
Possibly the better idea is setting up an auditd rule to watch /pub -
that's sorta what auditd is designed for.
--
Chris Murphy