Linux - unmount a busy target safely
Goal - removing target without data loss
Unplugging or unmount -l
(lazy unmount) can cause data loss. I want to share a way o avoid data loss.
Side note: unmount -l
will let you unmount the device, but as far as I know only 'hides' the mountpoint, and active processes can still write on said device.
The problem
Error unmounting /dev/sdc1: target is busy
So, there are now different ways to unmount the target safely.
Side note: the most common case is that you are still in a directory of said target. It happened way too often to me.
Preparation
Those steps are not necessary, but help you troubleshoot.
Finding the mount point
We are going to use df -h
to find the mount point of the busy target. It is often not necessary, but it can be helpful.
kuser@pleasejustwork:~$ df -h [...] /dev/sdc1 59G 25G 35G 42% /media/kuser/hdd-target
Check if the device is still actively in use
Additionally, you can check the activity of said device with iostat.
kuser@pleasejustwork:~$ iostat 1 -p sdc vg-cpu: %user %nice %system %iowait %steal %idle 1,14 0,00 0,63 2,66 0,00 95,56 Device tps kB_read/s kB_wrtn/s kB_dscd/s kB_read kB_wrtn kB_dscd sdc 13,00 0,00 7,50 0,00 0 7 0 sdc1 13,00 0,00 7,50 0,00 0 7 0
iostat
is powerful, but in this case the most important columns here are kB_read/s kB_wrtn/s
. If there is anything but 0,00
, the device is in use.
If there is any activity and you unplug or unmount the device forcefully, data loss will most likely occur.
Finding the process
Using 'fuser'
More information can be found in the manual of 'fuser'.
kuser@pleasejustwork:~$ fuser -vm /dev/sdc1 USER PID ACCESS COMMAND /dev/sdc1: root kernel mount /media/kuser/hdd-target kuser 43966 F.c.. kate kuser 44842 ..c.. kate
I prefer 'fuser' since it is installed on most OS and does the job too.
Using 'lsof'
More information can be found in the manual of 'lsof' (list open files).
kuser@pleasejustwork:~$ lsof /dev/sdc1 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME kate 43966 kuser cwd DIR 8,33 32768 1 /media/kuser/hdd-target kate 43966 kuser 24w REG 8,33 142 2176 /media/kuser/hdd-target/.busybusy.txt.kate-swp
or
kuser@pleasejustwork:~$ lsof /media/kuser/hdd-target COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME kate 43966 kuser cwd DIR 8,33 32768 1 /media/kuser/hdd-target kate 43966 kuser 24w REG 8,33 142 2176 /media/kuser/hdd-target/.busybusy.txt.kate-swp
Kill process / close program
- Kill process by PID:
sudo kill -9 43966
or simply close the program that is using the file in the GUI.
Unmount
Try to unmount again.
Some other methods
I have had no problems with those yet, but some notable mentions.
- Some other things to look into:
- check the swap partition:
cat /proc/swaps
- stop nfs-kernel-server
- stop samba/smb server
- check for symbolic links
There are more scenarios in which a target can be busy, but this should cover 95% of cases.
E-Mail hello @itta vern. com
Twitter ITTavernCom
Fediverse ITTavern
Lemmy infosec.pub/c/ittavern
More reading:
- 12.11.2023 Port Knocking with knockd and Linux - Server Hardening
- 08.11.2023 Getting started with rclone - Data transmission
- 24.10.2023 Getting started with dig - DNS troubleshooting
- 04.08.2023 Getting started with Fail2Ban on Linux
- 16.06.2023 Create tmux layouts using bash scripts
- 22.11.2023 SSH Server Hardening Guide v2
- 12.11.2023 Port Knocking with knockd and Linux - Server Hardening
- 08.11.2023 Getting started with rclone - Data transmission
- 01.11.2023 How to: Cisco ISE backup to SFTP repository with public key authentication
- 24.10.2023 Getting started with dig - DNS troubleshooting