Hi,

I have found out the problem with my system.  Apparently, after  
Sophos crashed the system and subsequent reboots, the root file  
system is mangled, for example, in /var/run directory, therefore the  
system crashed very early on.  Sadly, the OS does not detect the  
dirty file system / and fsck.ext3 without the -f flag sees it as  
clean. I have wasted a lot time/energy looking elsewhere.  Had I done  
a fsck.ext3 -f in the recuse mode, I would solve the problem fairly  
quickly.

Thanks.

On Jul 30, 2007, at 2:01 AM, Jan Iven wrote:

> On 27/07/07 23:08, Zhi-Wei Lu wrote:
>> Hi,
>>
>> I was playing with Sophos Antivirus for Linux (not really  
>> necessary in
>> my opinion, but ...) for an SL 5.0 system, the antivirus program  
>> crashed
>> the system.  I managed to remove the Sophos Antivirus software  
>> using the
>> install DVD.  However, the system crashes very early on in the  
>> booting
>> process.  It sets the hostname, then it tries to do LVM stuff and
>> something (fly by too quickly), then it crashes.  I couldn't get too
>> much from the kernel panic messages, it mentions about ext3  
>> filesystem
>> calls and among other.  Is there a way to capture all the booting
>> message to a file?
>
> /var/log/boot.log will contain some, but if the system goes down hard
> enough these maessages may actually not make it to disk. Especially if
> the crash occurs before the "/"-filesystem gets remounted in r/w-mode.
>
> Other than that, you could set up a serial console. This should  
> capture
> the system output during early boot reliably.
>
>> I suspect that it may be a problem with LVM and I played with SL5  
>> liveCD
>> and Install CD in the rescue mode, I was able to mount the logical
>> volume without any problem.  Any suggestion of how I should  
>> proceed!  I
>> did try the rc.sysinit
>> LVM commands by hand while in the LiveCD mode, the system was fine.
>
> Since Sophos promises to do "on-access" scanning on certain
> distributions, it could possibly be hooked up via a kernel module. I'd
> check /etc/rc.d/rc.sysinit for modifications from Sophos, such as
> inserting modules (both "hostname setting" and "LVM setup" should  
> happen
> in that script).
>
> Regards
> jan

Zhi-Wei Lu
Institue for Data Analysis and Visualization (IDAV)
UC Davis                     Phone:    (530) 752-0494
Davis, CA 95616        Fax:         (530) 752-8894