On Fri, Jan 28, 2022 at 10:50 AM Ulrich Windl <Ulrich.Windl@xxxxxxxxxxxxxxxxxxxx> wrote:
Hi!
When upgrading SLES15 to SP3, a newer version of systemd was installed (246.16+suse.191.g3850086c65).
Since then I see new journal messages like these that I cannot associate with a unit:
Jan 27 09:29:30 h16 systemd[1]: var-tmp-AP_0xC5KDJP.mount: Succeeded.
Jan 27 09:29:30 h16 systemd[22591]: var-tmp-AP_0xC5KDJP.mount: Succeeded.
Where do these messages originate from, and couldn't they be improved? Or is it some debug-leftover?
I do not see corresponding names in /var/tmp.
If I understand correctly, the messages indicate that the filesystem was *unmounted*, and the same program which did mounting/unmounting immediately cleaned up the mountpoint as well.
(systemd reacts to external mounts as those also contribute to dependencies.)
If OpenSuSE has the kernel audit subsystem enabled, try using `auditctl` to monitor a) what process executes mount-related syscalls, b) what process creates directories under /var/tmp.
Mantas Mikulėnas
