Page Comparison

...

The Checkmk Appliance uses something called an overlay file system. This enables a read-only firmware, which cannot be tampered with, while still allowing configuration to be changed (through the web configuration).
As the name suggests, these file system has layers, where the lower layer is read-only, and the upper layer can be written to. This results in a "merged" file system, mounted at the root (/) of the directory tree.
So you will find three main directories: /ro/, which is the read-only file system, /rw/overlay-rw/,  which contains the modifications and /  which is the actual root of the running operating system.

...

First, identify the files, which were changed. The resulting listing should mostly contain files, which are expected to have been changed, so this article will focus on the /etc/  directory.

1. Log in as root.
   
   
2. You can inspect the file system structure in /, but the actual changes reside in /rw/overlay-rw/


3. Run the following command to find all changed files (you can pipe it to a file as well for easier inspection): find /rw/ 
   
   
4. Now let's run a more narrow search to only find the changed files in /etc/ : find /rw/ | grep "/rw/overlay-rw/etc/" 
   
   
5. Let's say, you found this file, and you know you modified it: /rw/overlay-rw/etc/check_mk/logwatch.cfg
   1. You can remove the changes by running rm /rw/overlay-rw/etc/check_mk/logwatch.cfg
   2. Do NOT remove the file at /etc/check_mk/logwatch.cfg! This would remove the whole file and not only custom changes!
      
      
6. Reboot the appliance. This is necessary due to the way the overlay filesystem works.
   1. Remounting the root file system works as well and is less disruptive: mount -o remount /, but if you are in doubt, reboot.
      
      
7. Congratulations, you have reverted the file to its factory default.
   
   

Related articles

...