criticalAdvancedSymptom-first#filesystem#readonly#mount#disk-errors

Root filesystem readonly — EROFS errors

Read-only file system errors when writing

Likely source:availabilitydata-loss

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Read-only file system errors when writing
  • mount -o remount,rw fails with errors
  • dmesg shows EXT4-fs error or I/O errors

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Mount options

    mount | grep ' / '
  • Kernel I/O errors

    dmesg | grep -i 'error\|readonly\|remount\|ext4\|I/O'

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • dmesg shows I/O errors or blk_update_request errors
  • Disk SMART data shows reallocated sectors

Confirm before fixing

smartctl -a /dev/sda | grep -i 'reallocated\|pending\|uncorrectable'
READ

Check SMART health data on the disk

Fix

mount -o remount,rw /
CHANGE

Try remounting as a temporary fix; plan disk replacement

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
mount | grep ' / '
READ

Confirm the root filesystem is readonly

2
dmesg | grep -i 'error\|readonly\|remount' | tail -30
READ

Find the reason the kernel remounted readonly

3
mount -o remount,rw /
CHANGE

Attempt to restore read-write access

4
shutdown -r now
DESTRUCTIVE

Reboot into single-user mode and run fsck if remount fails

Prevention

  • Use UPS with automatic shutdown to prevent unclean power loss.
  • Monitor SMART health and alert on reallocated/pending sectors.
  • Run periodic filesystem checks (e2fsck) during maintenance windows.
  • Use a separate /var partition so a rootfs readonly does not lose all logging.

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.