Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Ubuntu 11.10 Gnome.

I uninstalled snort in order to install a more recent version. The new installation initially failed because the system would not let be rm or modify /var/log/snort even as root.

sudo chattr -i /var/log/snort/*

enabled me to remove the contents of /var/log/snort although the i attribute did not appear to have been set.

However sudo chattr -i /var/log/snort did not allow me to remove /var/log/snort itself although only the e attribute was set.

I was able to change ownership of /var/log/snort but that does not help

peter-Inspiron-620:/var/log$ ls -ld /var/log/snort
drwxrws--- 2 root adm 4096 2013-05-20 23:22 /var/log/snort
peter-Inspiron-620:/var/log$ sudo rmdir /var/log/snort
[sudo] password for peter: 
rmdir: failed to remove `/var/log/snort': Operation not permitted
peter-Inspiron-620:/var/log$ sudo rm -rf /var/log/snort
rm: cannot remove `/var/log/snort': Operation not permitted
peter-Inspiron-620:/var/log$ sudo chown peter /var/log/snort
peter-Inspiron-620:/var/log$ ls -ld /var/log/snort
drwxrws--- 2 peter adm 4096 2013-05-20 23:22 /var/log/snort
peter-Inspiron-620:/var/log$ rmdir /var/log/snort
rmdir: failed to remove `/var/log/snort': Permission denied
peter-Inspiron-620:/var/log$ rm -rf /var/log/snort
rm: cannot remove `/var/log/snort': Permission denied

I tried rebooting the computer and going into the root shell in restore mode but was still unable to remove this directory.

share|improve this question
Have you tried fscking the disk that the directory lives on? – msw May 24 '13 at 3:14

You can find out the current instances on the directory using the command

lsof +D /var/log/snort

This will help you to find out the current processes which are using files present in the directory you are searching for in your case it's /var/log/snort.

share|improve this answer

Check if another process is accessing the file:

sudo fuser /var/log/snort
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.