Linux in read-only mode

Hi,

I'm not very familiar with linux, expecially when it has crashed. We tried to reboot a RedHat Enterprise 4 machine and it wouldn't start up normally. The thing is that the partion (I think thats what its called but correct me if i'm wrong) that holds the /etc/ folder has no free space, so the fstab file is empty. After the reboot, we keep getting sent to a shell promt, except that whenever we try to empty out the /etc folder, it says its a read-only filesystem, but if I try to write to /var, it allows me to. How can I gain the ability to erase on the /etc drive?

Thanks ahead.

Sounds to me that the partition that is mounted on /etc needs to have fsck run against it to make it clean and marked to be mounted writeable.

Does it mention on boot up that the partition for /etc was not shut down cleanly, it should also attempt to run fsck against it.

If you can, boot into single user mode and run fsck against it

Do you know if it is ext2 or ext3 ?

if it is ext3 the command would look like

fsck.ext3 -y /dev/hdxx or
if it is scsi
fsck.ext3 -y /dev/sdxx

the device being what ever device it is for /etc in the fstab on the right, Which in your case you sound like you might have to guess it, since /etc is the location of these files and that is also where you are having problems.

[edit]
Another option is to boot off of a bootable cd such as knoppix or backtrack, then see if you can see the hard drive devices to run fsck against them. Doing it this way the original /etc is not necessary.
[/edit]

I'll try the fsck command. I believe it is in ext2 because it says something uppon bootup about ext2. Also, I have tried knoppix and it was unable to mount the partition. I'm trying the rescue mode on the Linux installation disk, but no luck there either. I think someone else tried the fsck command, but neither he nor I knew how to use it so I shall try your way.

Any more idea's? I'll post an update soon.

Thanks ahead.

[edit]

Ok, I ran the fsck command on the drive and it gave me this.

Quote:

---

The superblock could not be read or does not describe a correct ext2 filesystem. If the device is valid and it really contains an ext2 filesystem, then the superblock is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>

---

The only thing is, I really don't know how are what to use that command for. I also tried it as an ext3 filesystem just in case but no luck there either.

[/edit]

In knoppix, you don't really want to mount the /etc device, you need to just find it to run fsck against it. It is best to run fsck on devices that are not mounted anyways.

I ran the command through the linux rescue disk and got the above again. I'm loading knoppix and trying out your suggestion.

[edit]
Same thing with knoppix also. I tried running the command it gave me but I got the same errors.

I don't know if this is any help, but I can explore the drive when it boots without a bootable cd.
[/edit]

Just be careful, if it isn't a ext2 filesystem but you rebuild it as if it were and create a new superblock, you may lose it for good.

Something is not right. It could be complaining about the bad superblock because you have not used the correct file sytem type. If I am not mistaken, Red Hat Enterprise defaults to a ext3 file sytem at install.

I know you've stated you tried ext3. I'd step away for a cigarette or a coffee for a few then come back and go at it as if you've just begun, take your time.

[edit]
My bad, it seems that e2fsck works with both ext2 and ext3 try this.

e2fsck -y /dev/hdxx

ext3 is nothing more than a ext2 that supports journalling, which is used for cleaner recoveries.

Last resorts you could always attempt to trun the e2fsck against the mounted drive, it sometimes works, but isn't really suggested

[/edit]

A couple of questions:

How are you trying to start it?

Do you have SELinux enabled?

Ok, an alternative thought is that all I need is the information in the /var folder. I can see it when it boots, and I just need to get that to a portable hard drive. The fsck command gives me the same error when i run it as an ext3 file type, which it turns out we already tried yesterday according to the person i'm working with. Now if I can just get the usb harddrive to mount in the default rescue mode, then I can copy /var over to it. The only thing is I can't get it to mount.

One question. What is SELinux and how do I know if its running?

I am starting linux by just booting it up. Don't know what else you mean by that. Again, I tried the e2fsck command and still got the same error.

Thanks ahead

SELinux = Security Enhanced Linux put out by the NSA. It is distributed in Red Hat Enterprise 4.

I'm pretty sure it is defined or turned on via the kernel config, I'll concede to IKnowNot on that though