Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Help decoding System.log entry

Hello,

Does anyone know what this entry in the System log means?

Jul 23 14:40:19 www fseventsd[43]: failed to make the directory /private/tmp/278/E/.fseventsd (1/Operation not permitted)
Jul 23 14:40:59 www fseventsd[43]: scan_old: bailing out because device mounted @ /private/tmp/278/E has dls 0x0 and dls->fci 0x0

Does it mean I should do anything ... ?

Thanks in advance for the help.

Powermac G5 2.3 Dual, Mac OS X (10.5.4), 4.5Gbytes

Posted on Jul 23, 2008 6:45 AM

Reply
Question marked as Best reply

Posted on Jul 23, 2008 12:48 PM

Probably not. fseventsd is the daemon responsible for reading filesystem events from a special device file in /dev/ (basically, from the kernel), and writing those events to log files stored in directories named .fseventsd.

Each filesystem volume that exists and has events associated with it will have a .fseventd directory at its root. For example, take a look in your / directory and you'll see one (to look inside, you'll need to be root or use sudo).

The whole reason for the daemon's existence is so that any other application on the Mac can take advantage of filesystem events without having to read directly from the kernel. Instead, they read from ordinary log files.

What that error is saying is that you have some external disk or disk image (i.e. volume) attaching itself to a directory in /private/tmp, and fseventsd is having problems setting up the proper log file directory in order to make filesystem events work for that volume. The "1/Operation not permitted" message is a standard error code, "1" being the numeric code and "operation not permitted" being the corresponding string code. This error typically means that the underlying filesystem (in this case, your mystery volume) is purposefully denying the creation of the object in a way _other than_ by permissions. For example, there could be a file flag set making the root of the filesystem immutable.

To understand more, it would be helpful to know what is attaching itself to that area in your tmp directory. Regardless, I don't think the errors are much to worry about...
8 replies
Question marked as Best reply

Jul 23, 2008 12:48 PM in response to Gavin Lawrie

Probably not. fseventsd is the daemon responsible for reading filesystem events from a special device file in /dev/ (basically, from the kernel), and writing those events to log files stored in directories named .fseventsd.

Each filesystem volume that exists and has events associated with it will have a .fseventd directory at its root. For example, take a look in your / directory and you'll see one (to look inside, you'll need to be root or use sudo).

The whole reason for the daemon's existence is so that any other application on the Mac can take advantage of filesystem events without having to read directly from the kernel. Instead, they read from ordinary log files.

What that error is saying is that you have some external disk or disk image (i.e. volume) attaching itself to a directory in /private/tmp, and fseventsd is having problems setting up the proper log file directory in order to make filesystem events work for that volume. The "1/Operation not permitted" message is a standard error code, "1" being the numeric code and "operation not permitted" being the corresponding string code. This error typically means that the underlying filesystem (in this case, your mystery volume) is purposefully denying the creation of the object in a way _other than_ by permissions. For example, there could be a file flag set making the root of the filesystem immutable.

To understand more, it would be helpful to know what is attaching itself to that area in your tmp directory. Regardless, I don't think the errors are much to worry about...

Jul 23, 2008 1:38 PM in response to glsmith

Hi - thanks for the very helpful answer.

The event is being triggered by a write via SFTP to a folder on the main disk of a mac mini (intel). The folder is not the root (/) but one that is off the root (i.e. /folder). The mac mini is being used as a simple file store accessed via SFTP - so nothing much else is going on apart from SFTP read / writes.

I'm not sure what the SFTP transactions are that cause the error - but I know one came when I tried (successfully) to write a file to the /folder area.

The system is running 10.5.4 client.

If that helps, great. If there is other info that you'd find helpful to know let me know etc.

Jul 23, 2008 2:36 PM in response to Gavin Lawrie

Hmm.. How are you establishing the sftp connection? Something simple like

sftp 1.2.3.4

and then you cd to your folder, then "put" the file? Is this just the "sftp" that comes with the SSH package on the Mac?

I have no idea why that program would be doing that... Are you using something like MacFUSE? Are you using Parallels?

Message was edited by: glsmith

Jul 23, 2008 3:00 PM in response to glsmith

Hi

Just using simple SSH / SFTP as ships with OS X. Links established by various FTP clients - e.g. Transmit etc. or using terminal. Only SFTP connection is being made using a dedicated non administrator account.

The Mac Mini has Parallels running on it, but it has its own IP, and doesn't do anything directly with the OS X file system. But I think Parallels loads MacFUSE as part of its presence.

Does this help?

Message was edited by: Gavin Lawrie

Jul 23, 2008 3:15 PM in response to Gavin Lawrie

The Mac Mini has Parallels running on it, but it has its own IP, and doesn't do anything directly with the OS X file system. But I think Parallels loads MacFUSE as part of its presence.


I think Parallels is using /private/tmp to mount something, possibly the "E" drive? Is it possible that Parallels is set up to show virtual disks on the Mac desktop? This would explain the mount, and possibly the reason fseventsd is having issues with the volume.

This is looking more like a Parallels issue, and nothing to do with SFTP...

Jul 24, 2008 7:25 AM in response to glsmith

I am having a problem with Parallels hanging, even when it is inactive in the background. I am seeing the same fseventssd error in the system log file when Parallels hangs. Has anyone had this experience? Parallels tech support is telling me that there is some other software that is causing this or that I have a hardware problem. The problem seemed to start when I upgraded to MacOS X 10.5.4 and Parallels build 5600 (it also happens with build 5608).

Help decoding System.log entry

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.