Re: "Filesystem flags changed" alerts since 5.22

[Martin Pala]

Hello Paul,

the problem may occur, if you monitor the root filesystem using the mountpoint 
("/") and the system has an rootfs overlay like this:

        $ cat /proc/mounts 
        rootfs / rootfs rw 0 0
        /dev/sda1 / ext3 rw,data=ordered 0 0

When monit scans the table, it finds the first rootfs mount with "rw" flags and 
then the second entry for /dev/sda1 with "rw,data=ordered" flags. This triggers 
the filesystem change event. The virtual rootfs filesystem is present on some 
platforms only (for example Ubuntu doesn't show it).

Workaround: use device instead of mountpoint for root filesystem monitoring 
(the device is more specific and doesn't match the whole overlay mount tree).

We have fixed the problem in the development version, if you want to test, you 
can compile it this way:

wget https://bitbucket.org/tildeslash/monit/get/master.tar.gz
tar -xzf master.tar.gz
cd tildeslash*
./bootstrap
./configure
make

Best regards,
Martin



> On 20 Apr 2017, at 02:04, Paul Theodoropoulos <address@hidden> wrote:
> 
> Another addition, apologies for not having this all rolled into my original 
> message - I'm not getting alerts, only warnings within monit summary, and 
> m/monit.
> 
> On 4/19/17 16:45, Paul Theodoropoulos wrote:
>> I should also add that it is only 'rootfs' that generates the error. If a 
>> machine has additional mount points that are checked, they show no error.
>> On 4/19/17 15:47, Paul Theodoropoulos wrote:
>>> I'm getting lots of alerts for "Filesystem flags changed" since immediately 
>>> after updating to 5.22.
>>> 
>>> Debian 8.7
>>> 
>>> All of my machines have at least the following in their confs:
>>> 
>>>     check filesystem rootfs with path /
>>>     if space greater 90 % then alert
>>> 
>>> No other types of filesystem tests are being performed. I noticed that the 
>>> docs say that the filesystem changed test is implicit. The problem is that 
>>> the filesystem hasn't changed. Here's the specific error message generated 
>>> by monit. These are all servers that have been up quite a while.
>>> 
>>> filesystem flags changed to rw,relatime,nobarrier,data=ordered
>>> 
>>> Am I doing something wrong?
>>> 
>>> 
> 
> -- 
> Paul Theodoropoulos
> www.anastrophe.com
> 
> --
> To unsubscribe:
> https://lists.nongnu.org/mailman/listinfo/monit-general