Logwatch - mdadm: cannot open /dev/md0: No such file or directory

Hi all,

I am running Logwatch on Tumbleweed and I am receiving the following error in each daily log:


--------------------- Mdadm Begin ------------------------

mdadm: cannot open /dev/md0: No such file or directory

---------------------- Mdadm End -------------------------

That device does indeed exist:

❯ sudo mdadm -D /dev/md0
/dev/md0:
           Version : 1.0
     Creation Time : Fri Dec 10 17:38:02 2021
        Raid Level : raid1
        Array Size : 2097792 (2.00 GiB 2.15 GB)
     Used Dev Size : 2097792 (2.00 GiB 2.15 GB)
      Raid Devices : 2
     Total Devices : 2
       Persistence : Superblock is persistent

     Intent Bitmap : Internal

       Update Time : Sun Dec 19 01:01:39 2021
             State : clean
    Active Devices : 2
   Working Devices : 2
    Failed Devices : 0
     Spare Devices : 0

Consistency Policy : bitmap

              Name : any:0
              UUID : b6ba0f50:28ce8e53:7b557166:d568e6b1
            Events : 22

    Number   Major   Minor   RaidDevice State
       0       8       19        0      active sync   /dev/sdb3
       1       8       20        1      active sync   /dev/sdb4

I don’t see anything useful doing:

❯ journalctl -g mdadm
Dec 15 00:00:43 hostname logwatch[3148]:  --------------------- Mdadm Begin ------------------------
Dec 15 00:00:43 hostname logwatch[3148]:  mdadm: cannot open /dev/md0: No such file or directory
Dec 15 00:00:43 hostname logwatch[3148]:  ---------------------- Mdadm End -------------------------

It’s just the same message I receive in the email.

Does anyone have any suggestions on how to troubleshoot this? I’m also having another issue with logwatch where it’s not reporting smartd information at all.

I’ve only added three local logwatch configuration items in:

> sudo vi /etc/logwatch/conf/logwatch.conf
# Local configuration options go here (defaults are in /usr/share/logwatch/default.conf/logwatch.conf)
MailTo = mymailto@host.com
MailFrom = mymailfrom@host.com
Output = mail

I have not touched the default config file located here:

/usr/share/logwatch/default.conf/logwatch.conf

One other oddity, when I manually run:

> sudo logwatch

the mdadm section is not present at all in the output email.

Thank you

If your service is started by systemd, it could be denied access to /dev as part of ongoing service hardening. Post full service definition (systemctl cat your-service-name.service).

Thank you. Please see below:

❯ sudo systemctl cat logwatch.service
# /usr/lib/systemd/system/logwatch.service
[Unit]
Description=Log analyzer and reporter
Documentation=man:logwatch(8) man:logwatch.conf(5)
Before=logrotate.service

[Service]
# added automatically, for details please see
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
ProtectSystem=full
ProtectHome=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
# end of automatic additions
Type=oneshot
# This first EnvironmentFile has the Logwatch default variables
EnvironmentFile=-/usr/share/logwatch/default.conf/systemd.conf
# This second EnvironmentFile is meant for system-specific
# customization of variables, including overriding the defaults
EnvironmentFile=-/etc/logwatch/conf/systemd.conf
ExecStart=/usr/sbin/logwatch $LOGWATCH_OPTIONS

Looks like PrivateDevices might be the issue?

Yes. You should open bug report for this package.

Will do. Thank you very much for your help. I’m not sure if or when I would have thought to check the service definition.

There still seems to be an issue with logwatch and RAID. In my daily email from logwatch this is all it displays:

 --------------------- Mdadm Begin ------------------------
 
 /dev/md0 :
 
 ---------------------- Mdadm End -------------------------