We have a logstash (CentOS) server that keeps logs from a bunch of other Win/Lin servers. For some reason, it just went in to RO mode and appears to have some corruption on the disk. After I noticed the system was RO and Apache wasn't working, I simply rebooted the server and it came back with:

/dev/mapper/logstash-root: UNEXPECT INCONSISTENCY; RUN fsck MANUALLY. (i.e. without -a or -p options) 

I tried to do that. I booted in to a Ubuntu Live CD and attempted to run fsck /dev/sda1 and sdb but it only replied back with "fsck from util-Linux 2.20.1. Nothing seeemed to happen after that. What confuses me is do I run the fsck with /dev/mapper? I thought that I had to use a specific /dev/ like sda or sdb or something? The mapper thing is throwing me off. Should I just run FSCK to that?

I'm somewhat new to Linux and very new to this job. I have no one else to really run stuff by at this time since the previous guy left so just want to make sure I don't mess something up. I am currently accessing this from VMWare since the networking is not working on the logstash server.

I attached some screenshots that I hope will help!

enter image description here enter image description here

  • 1
    Yes, you need to fsck the device with the actual filesystem on it. In this case, it's the LVM volume /dev/mapper/logstash-root.
    – jordanm
    Commented Feb 21, 2017 at 23:58
  • AWESOME! I was able to FSCK it with the /dev/mapper/... path. Appears to be working now! thanks
    – saleetzo
    Commented Feb 22, 2017 at 0:10

1 Answer 1


Was able to run this through a Ubunutu LiveCD and fsck the /dev/mapper/logstash directory...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .