What to do after more than 20 "/sbin/fsck -y" and the result still NOT OK??

[henry_hkg]

Last night after my regular /sbin/fsck -y, the system return the following:


** Root file System
** Checking HFS Plus volume
** Checking Extents Overflow file
** Checking Catalog file
** Checking multi-linked files
** Checking Catalog hierarchy
** Checking volume bitmap
** Checking volume information
** Repairing volume

***** FILE SYSTEM WAS MODIFIED *****

I then issued another /sbin/fsck -y hoping that the system could correct the error and return an "OK" message. After repeating after 20 times, the same error message returns. I was installing iPhoto, Java 1.3.1 update and doing internet before I issuing the command.

My question is :

1) How many more times should I try to /sbin/fsck -y before the System can correct the error?

2) What else can I do to correct this error?

3) If I choose to ignore this error, what is my risk?

4) Is there any way to repeat issuing /sbin/fsck -y apart from typing it each time? I recall reading somthing that you can use the arrow key to move the cursor back over the command but in my case the cursor do not move upward and display "A" each time I press the backward arrow key and it display another letter if I press another arrow key.

5) How to do a screen dump in the single user mode for me to copy the screen message and post here rather than copying and typing all those screen message again.

I appreciate your feedback.

Henry

[mervTormel]

henry, after three or four, and the output doesn't change, you've got to figure you've got a file system that can't be corrected with fsck.

risk depends on the severity of the error.

in single user mode, root is running the basic shell, sh. if you were to...

localhost # exec tcsh

then you could use up-arrow/down-arrow to step thru command history.

unfortunately, to get a script of the session, you need to mount the file system.

then, you could use the script command ( % man script ) which starts a new sub-shell writing all output to the file named ./typescript

but, i don't think you can run fsck on the mounted file system, so you would have to run it from another writable startup disk to capture the session.

what are the repeating error messages like?

do you have an OS9 install and any disk utilities?

i will delve deeper to see if we can find a solution.

[mervTormel]

henry, turns out i was able to mount the filesystem, start a script and fsck the volume. so, get to single user mode and...

# mount -uw /

# script
Script started...

# /sbin/fsck -y
blah blah blah

# exit
Script done...

# reboot

after you're booted, copy the root /typescript file to your home dir, open it in textedit and copy/paste the [brief] contents of the script file here and we'll go from there.

[henry_hkg]

I installed an OS 10.1.3 on my internal 13GB HD and also installed an OS 10.1.3 on my 80GB Fireware external HD. I have NOT installed any OS 9 onto my HD and I currently do NOT run any OS 9 applications or utilities.

Actually I did experience some major error and after using fsck many times without success in correcting the error, I decided to reinstall the whole OS again last week.

OK I will follow your instruction and post the output later. Thank Tormel

Henry

[henry_hkg]

Hi Tormel

I have followed your instruction and the script is generated, but please excuse my ignorance, please give me instruction to move the root /typescript file to my home dir. After I move the /typescript file to my home dir, I should be able to see the file on my OS X desktop finder and use textedit to open it, right?

Actually the few lines of out put as far as I can see is the same as those I typed above.

Henry

[mervTormel]

oh, in the finder, just go to the root volume and drag the typescript file to your home dir.

--
Actually the few lines of out put as far as I can see is the same as those I typed above.
--

are you saying that there are no enumerated exceptions in the fsck output, just ***** FILE SYSTEM WAS MODIFIED ***** ?

usually, we would expect to see something in the output that caused fsck to modify the file system.

i thought you had more fsck output to report, but it was too onerous to record it at single startup mode. *sigh*

[henry_hkg]

I know what you mean of all those extra error message after doing a fsck if in error, but in this case there is no such extra messages.

Here is the script :

Script started on Sat Mar 2 15:02:04 2002

localhost# //sbin.fsck     /fsck -y


** /dev/rdisk1s9

** Root file system

** Checking HFS Plus volume.

** Checking Extents Overflow file.

** Checking Catalog file.

** Checking multi-linked files.

** Checking Catalog hierarchy.

** Checking volume bitmap.

** Checking volume information.

** Repairing volume.



***** FILE SYSTEM WAS MODIFIED *****



***** REBOOT NOW *****


localhost# eexit



Script done on Sat Mar 2 15:03:03 2002

I tend to recall seeing those extra code messages the 1st time (last night) but after I re-run fsck, those extra code messages is gone and the same message (as above) appear each time I run fsck now.

Henry

[mervTormel]

aha!

don't you think the **reboot now** message is important to mention?


repeat the entire single user scenario, and when it says reboot now, type

# reboot -n

that'll reboot without flushing the disk buffers and undoing the fsck fix.

[henry_hkg]

(1) The ** reboot message was not there as I have been entering nearly 20 times /sbin/fsck -y and watch its error report each time. The ** reboot message appears after I follow the instructions of
# mount -uw /
# script
# /sbin/fsck -y
# reboot

as # exit does not work in this case the way to exist from the single-user mode is to REBOOT under this situation. # exit will start another Script started.......

(2) So after reading your last message of starting the single-user, go through the whole fsck process and issue # reboot -n. I restart from apple menu, the monitor shows:

Unresolved kernel trap(cpu 0): 0x400 - Inst access DAR=0x80004240
PC=0x00000000
Latest crash infor for cpu 0:
Exception state (su=0x16929000)
PC=0x00000000; MSR=0x40009030; DAR=0x80004240;
DSISR=0x40000000; LR=0x001fdb80;
R1=0x1034ba30; XCP=0x00000010 (0x400 - Inst access)
Backtrace:
0x0008a4b0 0x1681fbac 0x16e89210 0x16edb2cc
0x16edb42c 0x16edc148 0x16edc388 0x001cf7a8
0x001ce754 0x001ce6d4 0x00032ff0 0x0008bfb8
kernel loadable modules in backtrace: [[to be continue.....]]

[henry_hkg]

(2) continue from above.......

Kernel loadable modules in backtrace :
com.apple.iokit.IOUSBUsarClient(1.8.8)@0x1681c000
com.apple.driver.AppleUSBOHCI(1.8.7)@0x16ed8000
com.apple.iokit.IOUSBFamily(1.8.7)@0x16e87000
Kernel loadable module dependencies:
com.apple.iokit.IOPCIFamily(1.1)@0x168ad000
com.apple.kernel.mach(5.3)@0x0
com.apple.kernel.libkern(5.3)@0x0
com.apple.kernel.iokit(5.3)@0x0
Proceeding back via exception chain:
Exception state (sv=0x16929000)
previously dumped as "Latest" state. skipping...
Exception state (sv=0x16da7000)
PC=0x00000000; MSR=0x0000d030; DAR=0x00000000;
DSISR=0x00000000
LR=0x00000000; R1=0x00000000; XCP=0x00000000(unknown)
Kernel version:
Darwin Kernel Version 5.3:
Thu Jan 24 22:06:02 PST 2002; root:xnu/xnu-201.19.obj~1/RELEASE_PPC
memory access exception (1,0,0)

Waiting for remote debugger connection.
Options........Type
----------------------
continue 'c'
reboot 'r'

my machine LOCK at this point and do not accept any keyboard input at all. I ended up pressing the RESET BUTTON on the side of my iMac to restart

(3) After restarting the machine via RESET BUTTON, go into single-user mode and fsck, the display shows

** /dev/rdisk1s9
** Checking HFS Plus volume
** Checking Extents Overflow file
** Checking Catalog file
Invalid leaf record count
(It should be 96943 instead of 96945)
** Checking multi-linked files
** Checking Catalog hierarchy
** Checking volume bitmap
Volume Bit Map needs minor repair
** Checking volume information
Invalid volume free block count
(It should be 4945550 instead of 4945549)
** Repairing volume

***** FILE SYSTEM WAS MODIFIED *****

localhost#

(4) I did another fsck and the result is the same as above Without the following 5 lines:
Invalid leaf record count
(It should be 96943 instead of 96945)
Volume Bit Map needs minor repair
Invalid volume free block count
(It should be 4945550 instead of 4945549)

every lines are the same as above.

This is where I am now, sorry for the screen dump, I hope it points out some hints for you.

Looking forward for your comments......I need a break now

[mervTormel]

Quote: # mount -uw / # script # /sbin/fsck -y # reboot as # exit does not work in this case the way to exist from the single-user mode is to REBOOT under this situation. # exit will start another Script started.......

exit will end the script sub-shell, saying "Script done..." and return you to your parent shell, where you should issue # reboot -n

try again... single user mode...

# mount -uw /

# script
Script started...

# /sbin/fsck -y
repeat until message is "volume yourVolume appears to be okay"

# exit
Script done... # <- note: it says script done

# reboot -n

----
henry, once again, repeat fsck only four or five times; if the message doesn't change to okay, repeating 20 times isn't going to help.

[spodie]

There's another fsck you can use made specifically for HFS filesystems. It's called fsck_hfs. It fixes things a little differently than regular fsck and keeps in mind that the drive is HFS instead of UFS (Unix File System).

You must manually put in the logical location of your drive, but it seems to work for me very well. In single user mode, I type in fsck_hfs -y /dev/disk0s9 - it goes through the fsck process and makes any necessary changes. I was having some problems with OS X and fsck was not doing the job, almost exactly like you have stated. I used fsck_hfs and all my problems were magically fixed and everything was hunky-dory. Then yesterday something else happened.

My G4/867 was being poky and fsck_hfs or fsck would not do anything for the drive. I booted into OS 9.2 and ran Disk Warrior on my OS X volume. It found all sorts of problems with the directory and fixed them all. It found 224 orphaned indirect nodes and moved them into a "rescued items" folder. I trashed this folder and let Disk Warrior replace the directory.

I then ran Norton Utilities 6 to verify the files were all right. It fixed some minor things. Then I ran Norton Speed Disk on my OS X volume, using the option "Optimize for OS X".

Everything is cool now and my G4 is acting like it should in OS X. Remember that Norton Utilities 6 is designed to examine and fix problems with OS X, as long as you are booted into OS 9. See? OS 9 is still good for some things, namely NUM 6, because fsck does not always do what it's supposed to.

Just my 2 shekels...

[mervTormel]

thanks for the shekels, spodie.

i was under the impression that the -y switch to /sbin/fsck forced a call to fsck_hfs

i wish there were better docs on this thing as it has been largely heresay how it works.

anyhow, henry, try /sbin/fsck_hfs and if you get different results, post them here so we can observe.

[henry_hkg]

Here is the output recorded from the script:

Script started on Sun Mar 3 18:13:15 2002

localhost# //sbin/fsck_hfs -y/ dev     /fd  dev/disk1s9


** /dev/rdisk1s9

** Root file system
** Checking HFS Plus volume.
** Checking Extents Overflow file.
** Checking Catalog file.
** Checking multi-linked files.
** Checking Catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
** Repairing volume.

***** FILE SYSTEM WAS MODIFIED *****

***** REBOOT NOW *****

Then I type # reboot -n. Actually I have run /sbin/fsck_hfs -y for a few times and the ** Repairing volume.
****** FILE SYSTEM WAS MODIFIED ******

come out everytime. I think I might have to re-install the whole OSX again, the only concern I have is not knowing what are the causes and that means reinstalling might be part of using OSX. Thanks for both of your suggestions.



Henry

[stetner]

As far as I know, fsck means reboot now when it says it, not after a few more fsck's. The reason it says reboot now is because the inode tables etc cached in kernel memory may be different from the fixed version on disk. The '-n' option to reboot tells it to NOT flush the filesystem cache to disk, thereby maintining the fixes just done.

I would go through a reboot after every fsck personally.

As for the fsck vs fsck_hfs thing, fsck is supposed to be smart enough to determine if the file system is not ufs and to then invoke the correct fsck for the filesystem you are checking. In other words, if fsck does not give an error like 'bad magic number' or 'no super block at XXXX' and goes through the motions of checking, then the correct one is being called.

As for the '-y' option to fsck, that just means answer yes to every question it asks (which in most cases is what people want unless the know exactly what they want done to the filesystem, which most people don't 8-)

Cheers,

[mervTormel]

thanks doug.

henry, i echo what doug says, you ought to follow the directive given. when it says REBOOT NOW, issue that reboot -n command and come back up in single user mode and repeat the fsck.

Quote: As for the '-y' option to fsck, that just means answer yes to every question it asks (which in most cases is what people want unless the know exactly what they want done to the filesystem, which most people don't 8-)

the problem here is that omitting the -y switch, i don't get asked any questions. here, fsck behaves as if it was given the -y switch. once again, lack of any trusted documentation on this is vexing.

[WillyT]

Merv

I was just checking my system as having the fstab file seems to make fsck only check the swap partition.
Have 2 drives
10 G -9G OS 9 and 1G SWAP
60 G (6 x) 10G partitions one of which is OS X 10.1.3

Anyway I got this

invalid sibling link

error about the second time I ran fsck (after something about some orphaned inodes to tmp files which fsck seemed to fix)

fsck could not fix this?

After several reboots I booted from CD and Disk Utility couldn't fix it either.

So I booted to OS 9 (uggh) and Disk First Aid couldn't fix it.

I used Norton Disk Doctor which took 3 tries to fix this without error(kind of a pseudo crash without actually quiting but not updating the error log!?!)

I did not let Norton fix any bundle bits etc as I don't trust it for OS X files.

Then reversed the process:
Disk First Aid - ok
Disk Utility - ok
fsck -y - fixed some stuff
fsck -y ok

Had to restore fstab to get swap partition to mount correctly.

I don't seem to have broken anything.

[tjj]

Well, due to repeated app crashes, particularly Mail.app, I ran fsck from single user mode. ..and got this invalid sibling thing. After struggling for a while and getting nowhere, I stumbled over the option to rebuild the catalog B-tree (whatever that may be), using

/sbin/fsck_hfs -r /dev/disk0s9

That seemed to take care of the problem. My disk needed a minor repair and then fsck reported that the disk appeared OK.
Now it remains to be seen whether it also took care of my crashes

Powerbook G3 (Pismo)/500/1GB/10.2.6

[cybergoober]

I had a somewhat similar experience a while back. No matter how many times I ran "fsck -y", the fsck-ing thing said FILE SYSTEM MODIFIED.

I finally decided to run DiskWarrior (2.1.1 at the time, took forever too). After the rebuild was complete I rebooted into single user mode and fsck'ed again. This time it said that the volume appeared to be OK.

[tlarkin]

Diskwarrior 3 is out. I just would like to add my .02 real quick. I have had countless users thank diskwarrior for saving their data. Diskwarrior can do much more than any built in utility in the Mac OS.