# New (extra) raid devices being created. (resolved)

## toddles13

Hi All,

        have noticed since a recent reboot, my server running a couple of Sata drives in Software Raid 1 have started creating a couple of extra md devices in /dev.

More importantly in /dev/dev which is picked up by rkhunter scans as being signs of the Gaskit rootkit.

I still have the usual devices

```

 # ls -l /dev/md*

brw-r----- 1 root disk 9, 0 2008-05-05 12:11 /dev/md0

brw-r----- 1 root disk 9, 2 2008-05-05 12:11 /dev/md2

/dev/md:

total 0

lrwxrwxrwx 1 root root 6 2008-05-05 12:11 0 -> ../md0

lrwxrwxrwx 1 root root 6 2008-05-05 12:11 2 -> ../md2

```

But since a reboot last month there have been these extra device in /dev/dev

```

# ls -l /dev/dev/md*

brw-r--r-- 1 root root 9, 0 2008-05-05 12:11 /dev/dev/md0

brw-r--r-- 1 root root 9, 2 2008-05-05 12:11 /dev/dev/md2

```

dmesg looks normal 

```

md: raid1 personality registered for level 1

md: Autodetecting RAID arrays.

md: autorun ...

md: considering sdb3 ...

md:  adding sdb3 ...

md: sdb1 has different UUID to sdb3

md:  adding sda3 ...

md: sda1 has different UUID to sdb3

md: created md2

md: bind<sda3>

md: bind<sdb3>

md: running: <sdb3><sda3>

raid1: raid set md2 active with 2 out of 2 mirrors

md: considering sdb1 ...

md:  adding sdb1 ...

md:  adding sda1 ...

md: created md0

md: bind<sda1>

md: bind<sdb1>

md: running: <sdb1><sda1>

raid1: raid set md0 active with 2 out of 2 mirrors

md: ... autorun DONE.

ReiserFS: md2: found reiserfs format "3.6" with standard journal

ReiserFS: md2: using ordered data mode

ReiserFS: md2: journal params: device md2, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30

ReiserFS: md2: checking transaction log (md2)

ReiserFS: md2: replayed 682 transactions in 42 seconds

ReiserFS: md2: Using r5 hash to sort names

ReiserFS: md2: Removing [5 5273346 0x0 SD]..done

ReiserFS: md2: Removing [5 5273344 0x0 SD]..done

ReiserFS: md2: Removing [5 5273343 0x0 SD]..done

ReiserFS: md2: Removing [5 5273342 0x0 SD]..done

ReiserFS: md2: Removing [5 5273339 0x0 SD]..done

ReiserFS: md2: Removing [207525 75934 0x0 SD]..done

ReiserFS: md2: Removing [208086 51200 0x0 SD]..done

ReiserFS: md2: Removing [676313 48805 0x0 SD]..done

ReiserFS: md2: There were 8 uncompleted unlinks/truncates. Completed

```

Have mdadm installed with a simple config of 

```

DEVICE /dev/hd*[0-9] /dev/sd*[0-9]

MAILADDR xxx@xxxxx.xxx 

PROGRAM /usr/sbin/handle-mdadm-events

ARRAY /dev/md0 level=raid1 num-devices=2 UUID=aff0cf47:6481da40:1a5a92c7:208672e7

ARRAY /dev/md2 level=raid1 num-devices=2 UUID=7c1416fc:e5634a37:67af89c9:11098c4b

```

Is this normal or should I be looking further into it?

Am I supposed to only have "ARRAY md0 level ... ... " in my mdadm config.

Look forward to any ideas/suggestions for this.Last edited by toddles13 on Sun May 18, 2008 10:13 pm; edited 1 time in total

----------

## Sadako

Just a wild guess, but could /dev/dev just be a symlink to /dev?

Run `file` on the md nodes in /dev and /dev/dev, if they have the same major/minor numbers then they are actually just nodes for the same devices.

Also, what does `cat /proc/mdstat` tell you?

----------

## toddles13

Seems it is the same devices.

```

# file /dev/dev/md[0,2]

/dev/dev/md0: block special (9/0)

/dev/dev/md2: block special (9/2)

 # file /dev/md[0,2]

/dev/md0: block special (9/0)

/dev/md2: block special (9/2)

```

mdstat is normal

```
 cat /proc/mdstat 

Personalities : [raid1] 

md2 : active raid1 sdb3[1] sda3[0]

      193294016 blocks [2/2] [UU]

      

md0 : active raid1 sdb1[1] sda1[0]

      56128 blocks [2/2] [UU]

      

unused devices: <none>

```

/dev/dev is definitely not a symlink or a hard link to /dev (checked the inode numbers with ls -lid)

But it looks like they are hard links to each other.

```

# ls -li /dev/dev/md[0,2]

5120 brw-r--r-- 1 root root 9, 0 2008-05-05 12:11 /dev/dev/md0

5121 brw-r--r-- 1 root root 9, 2 2008-05-05 12:11 /dev/dev/md2

# ls -li /dev/md[0,2]

5020 brw-r----- 1 root disk 9, 0 2008-05-05 12:11 /dev/md0

5001 brw-r----- 1 root disk 9, 2 2008-05-05 12:11 /dev/md2

```

I suppose I can just rm the links.

I also have a couple of blank partitions on separate disks here so will try set up a raid array on my desktop machine and see if it creates these links to determine if it is a new Gentoo thing or an anomaly that should be investigated further.

----------

## toddles13

ok well, creating a new array on my desktop you get the following.

 *Quote:*   

>  # ls -l /dev/md/0 
> 
> brw-rw---- 1 root disk 9, 0 2008-05-08 17:04 /dev/md/0
> 
> # ls -l /dev/md0 
> ...

 

But on my server it creates it around the other way.

/dev/md* are the devices and /dev/md/* are the symlinks

Then there are hard links to the /dev/md* in /dev/dev/md*

----------

## Sadako

What kernel version of udev are you using on the two boxes?

That /dev/dev thing looks bloody weird to me...

----------

## toddles13

Now we might be onto something.

FYI both machines are AMD_64 one with X and the other set to -X

Kernel versions 2.6.23-gentoo-r6 (desktop) and 2.6.23-gentoo-r8 server.

udev on the other hand is totally different.

Server is on 119 and desktop is on 115-r1.

After syncing these were still the most up to date versions for each machine.

I double checked the profiles and found why there is a difference between them.

Desktop is

```
 # ls -l /etc/make.profile

lrwxrwxrwx 1 root root 59 2007-05-14 11:13 /etc/make.profile -> ..//usr/portage/profiles/default-linux/amd64/2007.0/desktop

```

Server is 

```
# ls -l /etc/make.profile

lrwxrwxrwx 1 root root 51 2007-05-25 02:14 /etc/make.profile -> ..//usr/portage/profiles/default-linux/amd64/2007.0

```

If I remember rightly there was a warning about using the /server profile so I stuck with the default.

Any way, am upgrading the desktop to 2008.0/desktop as it also uses udev 119 to see if that makes a difference.

Might try upgrade the server over the weekend to 2008.0/server and both kernels to 2.6.24

Will keep searching the forums and post results on Monday.

--edit-- 

Due to connection going down over weekend will have to put this off until next weekend (just in case I break something).

----------

## toddles13

Finally got a chance to take another look at this.

Updated to profile 2008.0

removed the two simlinks to /dev/md*

Rebooted and now the other devices are gone from /dev/dev/md*.

Also the symlinks have changed back to /dev/md/*

----------

