Can systemtap help in this case?

[William Cohen]

On 10/07/2011 04:24 PM, nealb wrote:
> 
> We've recently ran into an issue on one of our RHEL5.6 servers where our MBR
> is being zero'd out.  We are trying to identify if this is a vendor app
> causing this which does do queries on disk that are on the system and does
> have the capability of wiping disk, but isn't suppose to touch sda*.  Vendor
> says this isn't possible for there app to do this and pretty much told us to
> not open a case about this again. I was hoping systemtap might be able to
> say yay or nay on this.  I'm not familar with the language systemtap uses,
> but was hoping to know if this is something that systemtap could provide
> insight on what is causing the MBR to be zero'd out if it is truly software
> related and not hardware.  Any guidance/examples would be greatly
> appreciated and apologies in advance for the lack of knowledge on systemtap.   

Hi,

I think there is an example script to watch for this type of thing on:


http://sourceware.org/systemtap/examples/

The io/mbrwatch.stp listed on the page should do what you want.

-Will