1

I am using Ubuntu 11.10 Gnome.

I uninstalled snort in order to install a more recent version. The new installation initially failed because the system would not let be rm or modify /var/log/snort even as root.

sudo chattr -i /var/log/snort/*

enabled me to remove the contents of /var/log/snort although the i attribute did not appear to have been set.

However sudo chattr -i /var/log/snort did not allow me to remove /var/log/snort itself although only the e attribute was set.

I was able to change ownership of /var/log/snort but that does not help

peter-Inspiron-620:/var/log$ ls -ld /var/log/snort
drwxrws--- 2 root adm 4096 2013-05-20 23:22 /var/log/snort
peter-Inspiron-620:/var/log$ sudo rmdir /var/log/snort
[sudo] password for peter: 
rmdir: failed to remove `/var/log/snort': Operation not permitted
peter-Inspiron-620:/var/log$ sudo rm -rf /var/log/snort
rm: cannot remove `/var/log/snort': Operation not permitted
peter-Inspiron-620:/var/log$ sudo chown peter /var/log/snort
peter-Inspiron-620:/var/log$ ls -ld /var/log/snort
drwxrws--- 2 peter adm 4096 2013-05-20 23:22 /var/log/snort
peter-Inspiron-620:/var/log$ rmdir /var/log/snort
rmdir: failed to remove `/var/log/snort': Permission denied
peter-Inspiron-620:/var/log$ rm -rf /var/log/snort
rm: cannot remove `/var/log/snort': Permission denied
peter-Inspiron-620:/var/log$

I tried rebooting the computer and going into the root shell in restore mode but was still unable to remove this directory.

1
  • Have you tried fscking the disk that the directory lives on?
    – msw
    Commented May 24, 2013 at 3:14

2 Answers 2

1

You can find out the current instances on the directory using the command

lsof +D /var/log/snort

This will help you to find out the current processes which are using files present in the directory you are searching for in your case it's /var/log/snort.

0

Check if another process is accessing the file:

sudo fuser /var/log/snort

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .