Why is it dangerous to run e2fsck against an ext4 filesystem that is currently mounted read-write?
LPIC-1 Exam 101-500, objective 104. Devices, Linux filesystems, filesystem hierarchy standard medium
Draft — not checked yet. This question was written from the published exam objectives and cites the clause it comes from, but nobody has yet read it against that clause and signed for it.
It is kept out of search results and out of mock exams until they have. Read the source below before you take the answer as settled.
The options
Correct The kernel keeps changing on-disk structures while e2fsck reads and rewrites them, so the tool can act on a stale picture and corrupt the filesystem.
Correct. e2fsck assumes it is the only writer. A live filesystem violates that assumption, and repairs computed from inconsistent reads can destroy good data.
Not correct e2fsck simply refuses to start on any mounted filesystem, so nothing can be checked.
Wrong, and this is the dangerous misconception. e2fsck notices the mount and prints a warning, then asks 'Do you really want to continue?'; answer yes at a terminal and it goes ahead and checks the live filesystem. It aborts outright only when there is no terminal to ask on. The safety is a warning you can override, not a hard block.
Not correct e2fsck can only read ext2, so running it on ext4 silently downgrades the filesystem.
Wrong. e2fsck handles ext2, ext3 and ext4; it is the shared checker for the whole ext family and changes no feature flags on its own.
Not correct It clears the journal, which forces a full mkfs before the filesystem can be mounted again.
Wrong. Recovering or replaying the journal is a normal part of checking an ext3/ext4 filesystem and never requires re-creating it.
Why
Check filesystems offline: unmount them, or boot to rescue/single-user mode, or mark the root filesystem for checking at the next boot. Read-only mounts are the only reasonably safe live case. XFS behaves the same way — xfs_repair refuses a mounted filesystem outright.
Where this comes from
- Cited
- LPI exam objective 104.2
- What it says
- Verify the integrity of filesystems with fsck and e2fsck.
Practise this
Reading one question is not practice. The trainer will draw a set from objective 104 and space the ones you get wrong.