On Thu, Dec 31, 2020 at 11:09 AM Greg Woods <greg@xxxxxxxxxxxxxx> wrote: > > I suppose I should provide more info. /pub is a place where I store a bunch of stuff. In particular there are our photo and music collections, and rsync'ed Fedora repos (I rsync F32 and F33 repos once a day, then I use the local repo to perform updates on my 6 Fedora systems). > > The problem here is that, by the time I see one of these entries and investigate, the PID is for a process that is long gone, and I'm not getting any useful info about what command is triggering this. I'd guess that it's related to polling for repo differences. > Again, process 253560 is long gone, but at least I know that this automount was triggered by a dnf command. When the command is "PT3122", then I have no clue what triggered this automount. No idea. I think for this it's something of a heavy hammer, but you could try fatrace to see what's doing what, e.g. firefox(43214): W /mnt/home/chris/.mozilla/firefox/sfgorfus.default-release/storage/default/moz-extension+++cbf54e9c-1792-49aa-8511-5756bf926071^userContextId=4294967295/idb/3647222921wleabcEoxlt-eengsairo.sqlite-wal Process name and PID, write, path to file. You might want to cd /pub and run this with --current-mount option. Do that in a tmux pane and just walk away from it? I have seen it give up if there's too many reads/writes, but I don't know the parameters of when or why it stops. Possibly the better idea is setting up an auditd rule to watch /pub - that's sorta what auditd is designed for. -- Chris Murphy _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
