Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to find out what is trying to mount this file?

Jul 13 14:27:24 myhost automount[13527]: lookup(file): lookup for tmp_dir failed

Something is looking for "tmp_dir", and I've grepped a bunch of places but cannot find what script, program, etc... is looking for the file/dir and is causing automount to try and mount it up.

I see there are entries in /proc/mounts for tmp_dir, but looks like I cannot remove them since /proc/mounts is read-only (probably for good reason). Thoughts?

For a little background, we recently took down a file share that was called tmp_dir, and I think a programmer still has something pointing to tmp_dir, but he claims he cleaned everything up. I'm thinking maybe we did not umount tmp_dir properly before taking down the share, and autofs is still attempting to load it. The OS is SLES 11 SP1.

share|improve this question
See also Determine which process is creating a file. The automounter may introduce additional difficulties or additional opportunities, so I don't consider this question an exact duplicate. – Gilles Jul 13 '11 at 23:13
up vote 1 down vote accepted

Here are a couple of ways to monitor accesses to particular files. I'm not completely sure how they'll interact with an automounter, but they probably will work.

  • Put a LoggedFS filesystem on the automount directory (/amnt or whatever), and configure it to look out for /amnt/tmp_dir. Start from the provided configuration file example and tweak the include/exclude rules according to this guide.
  • Get the Linux audit subsystem utilities (on any recent distribution, this should just be a matter of installing a package), and make the kernel look out for this file:

    auditctl -a exit,always -w /amnt/tmp_dir

See also Determine which process is creating a file; my answer there has more explanations on LoggedFS and auditd.

share|improve this answer
Thanks, that is helpful. Just doing lsof on the particular directory provided some clues. lsof gave a warning saying it can't stat() the directory. Looks like /proc/mounts has some stale entries. How do I refresh /proc/mounts? restart nfs? I'll need to try that during off-hours as I imagine it would wreak some havoc on anyone working off nfs mounted directories. – Banjer Jul 15 '11 at 13:33
@Banjer There's no such thing as “refreshing” /proc/mounts: it's the real-time information straight from the kernel. – Gilles Jul 15 '11 at 14:49
I rebooted the server and it "cleared" those entries in /proc/mounts, so I no longer see failed automount lookups for tmp_dir in my logs. I'm not sure why /proc/mounts had those stale entries, but I'm guessing we did not properly unmount the folder before taking the share down on the nfs server. Those fs auditing tools you pointed me too will most likely come in handy for future issues. – Banjer Jul 18 '11 at 14:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.