Can systemtap help in this case?

[Adrien Kunysz]

On Fri, Oct 07, 2011 at 01:24:23PM -0700, nealb wrote:
> We've recently ran into an issue on one of our RHEL5.6 servers where our MBR
> is being zero'd out.  We are trying to identify if this is a vendor app
> causing this which does do queries on disk that are on the system and does
> have the capability of wiping disk, but isn't suppose to touch sda*.

examples/io/mbrwatch.stp
If it's not shipped in RHEL 5.6 you can get it from
http://sourceware.org/systemtap/examples/

This is a fairly common use case.

> Vendor
> says this isn't possible for there app to do this and pretty much told us to
> not open a case about this again. I was hoping systemtap might be able to
> say yay or nay on this.  I'm not familar with the language systemtap uses,
> but was hoping to know if this is something that systemtap could provide
> insight on what is causing the MBR to be zero'd out if it is truly software
> related and not hardware.  Any guidance/examples would be greatly
> appreciated and apologies in advance for the lack of knowledge on systemtap.   
> -- 
> View this message in context: http://old.nabble.com/Can-systemtap-help-in-this-case--tp32607395p32607395.html
> Sent from the Sourceware - systemtap mailing list archive at Nabble.com.
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
URL: <http://sourceware.org/pipermail/systemtap/attachments/20111007/2014167c/attachment.sig>