From owner-freebsd-questions@FreeBSD.ORG Sat Sep 27 23:54:06 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EE1371065688 for ; Sat, 27 Sep 2008 23:54:06 +0000 (UTC) (envelope-from fbsd.questions@rachie.is-a-geek.net) Received: from mail.rachie.is-a-geek.net (rachie.is-a-geek.net [66.230.99.27]) by mx1.freebsd.org (Postfix) with ESMTP id BB64E8FC1C for ; Sat, 27 Sep 2008 23:54:06 +0000 (UTC) (envelope-from fbsd.questions@rachie.is-a-geek.net) Received: from localhost (mail.rachie.is-a-geek.net [192.168.2.101]) by mail.rachie.is-a-geek.net (Postfix) with ESMTP id 9BEC0AFBC02; Sat, 27 Sep 2008 15:54:05 -0800 (AKDT) From: Mel To: freebsd-questions@freebsd.org Date: Sun, 28 Sep 2008 01:53:48 +0200 User-Agent: KMail/1.9.7 References: <6fcb5b8a45c5f63a10d863a009ee0700@localhost> <200809261548.28314.fbsd.questions@rachie.is-a-geek.net> <19701345.post@talk.nabble.com> In-Reply-To: <19701345.post@talk.nabble.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200809280153.48569.fbsd.questions@rachie.is-a-geek.net> Cc: Colin Brace Subject: Re: gateway NAT settings lost X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Sep 2008 23:54:07 -0000 On Saturday 27 September 2008 11:56:16 Colin Brace wrote: > Mel-15 wrote: > > The obvious a file in /, possibly a core dump. > > The less obvious, an open but deleted file. > > Even less obvious, a file in /tmp created in single user mode, without > > /tmp > > mounted. > > My money is on option 2: > > fstat -f / |sort -rnk 8|head > > OK, here is what that returns: > > $ sudo fstat -f / |sort -rnk 8|head > root init 1 text / 16492 -r-xr-xr-x 599320 r > root devd 618 text / 16467 -r-xr-xr-x 334060 r > root dhclient 1192 text / 16469 -r-xr-xr-x 74172 r > _dhcp dhclient 1231 text / 16469 -r-xr-xr-x 74172 r > root fstat 78768 5 / 49687 -rw------- 40960 r > root pflogd 478 text / 16527 -r-xr-xr-x 18716 r > _pflogd pflogd 481 text / 16527 -r-xr-xr-x 18716 r > root adjkerntz 136 text / 16457 -r-xr-xr-x 7244 r > www php-cgi 69281 root / 2 drwxr-xr-x 512 r > www php-cgi 1122 root / 2 drwxr-xr-x 512 r > > Do you see anything that looks unusual? Nope, and of course not, since it persists over reboot. It must be a directory you're not searching, maybe a dot directory. Best run *in single user mode*, with only / mounted: cd / du -h -d1 . > There is a tutorial here > .php> which explains how to do this using dump and restore. Just curious: > why is this preferable to using plain old cp? Because cp: - will copy foo/bar to dest/oops/bar if dest/foo is a symlink to dest/oops. - does not copy hard links, but both 'files' - cannot make consistent snapshots of a partition -- Mel Problem with today's modular software: they start with the modules and never get to the software part.