Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 14 Dec 2016 16:38:01 +0000
From:      Matthew Seaman <matthew@FreeBSD.org>
To:        freebsd-hackers@freebsd.org
Subject:   Re: ZFS - directory entry
Message-ID:  <08cf61a1-d1ff-66e9-81e7-371bb47eec34@FreeBSD.org>
In-Reply-To: <CAOtMX2i5_tL=jXcq2T5F2CkiQUVK9DoYofUsktNGXOHkmLaYRg@mail.gmail.com>
References:  <BEAC6EE9-C50F-4FB9-B215-D5A6691E2DD9@webweaving.org> <CAOtMX2i5_tL=jXcq2T5F2CkiQUVK9DoYofUsktNGXOHkmLaYRg@mail.gmail.com>

next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--COjCLCtdVp4jrOpsl240HElpCKFDuVJmC
Content-Type: multipart/mixed; boundary="WVX3CJwwNL5Lgqw5HAEm83cljO1aX9LhG";
 protected-headers="v1"
From: Matthew Seaman <matthew@FreeBSD.org>
To: freebsd-hackers@freebsd.org
Message-ID: <08cf61a1-d1ff-66e9-81e7-371bb47eec34@FreeBSD.org>
Subject: Re: ZFS - directory entry
References: <BEAC6EE9-C50F-4FB9-B215-D5A6691E2DD9@webweaving.org>
 <CAOtMX2i5_tL=jXcq2T5F2CkiQUVK9DoYofUsktNGXOHkmLaYRg@mail.gmail.com>
In-Reply-To: <CAOtMX2i5_tL=jXcq2T5F2CkiQUVK9DoYofUsktNGXOHkmLaYRg@mail.gmail.com>

--WVX3CJwwNL5Lgqw5HAEm83cljO1aX9LhG
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 2016/12/14 16:14, Alan Somers wrote:
> On Wed, Dec 14, 2016 at 8:27 AM, Dirk-Willem van Gulik
> <dirkx@webweaving.org> wrote:
>> A rather odd directory entry (in /root, the home dir of root/toor) app=
eared on a bog standard FreeBSD 10.2 (p18) lightly loaded machine under Z=
FS during/post a backup:
>>
>> $ ls -la /root | tail -q
>> ----------   1 root  wheel  9223372036854775807 Jan  1  1970 ?%+?kD?H?=
??x,?5?Dh;*s!?h???jw??????\h?:????????``?13?@?????OA????????Puux????<T]??=
?R??Qv?g???]??%?R?
>>
>> OS and ZFS is installed with a bog standard sysinstall. =E2=80=98SMART=
=E2=80=99 nor smartd have reported anything. nothing in dmesg, syslog of =
boot log. Any suggestions as how to debug or get to the root of this ?
>>
>> And in particular - what is a risk of a reboot (to get a kernel with d=
ebug, etc) causing the issue to =E2=80=98go away=E2=80=99 - and hence sto=
pping the forensic ?
>>
>> Dw.
>>
>> sudo zpool list -v
>> NAME         SIZE  ALLOC   FREE  EXPANDSZ   FRAG    CAP  DEDUP  HEALTH=
  ALTROOT
>> tank        25.2T  9.27T  16.0T         -    17%    36%  1.53x  ONLINE=
  -
>>   raidz3    25.2T  9.27T  16.0T         -    17%    36%
>>     ada0p3      -      -      -         -      -      -
>>     ada1p3      -      -      -         -      -      -
>>     ada2p3      -      -      -         -      -      -
>>     ada3p3      -      -      -         -      -      -
>>     ada4p3      -      -      -         -      -      -
>>     ada5p3      -      -      -         -      -      -
>>     ada6p3      -      -      -         -      -      -
>=20
> Two things to try:
> 1) zpool scrub.  This will reveal any corrupt metadata objects
> 2) Maybe the filename is created in an encoding not supported by your
> current terminal.  Try "LANG=3Den_US.UTF-8 ls -l"
> 3) Use zdb to examine the file.  First, do "ls -li /root" to get the
> object id.  It's the same as the inode number.  Then, assuming /root
> is in the tank/root filesystem, do "zdb -ddddd tank/root <object id>".
> That might reveal some clues.
>=20

That file size is one less than 8192 PiB or 0x7fffffffffffffff bytes.
That would be pretty impressive, if it was real.

	Cheers,

	Matthew





--WVX3CJwwNL5Lgqw5HAEm83cljO1aX9LhG--

--COjCLCtdVp4jrOpsl240HElpCKFDuVJmC
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQJ8BAEBCgBmBQJYUXVvXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxOUYxNTRFQ0JGMTEyRTUwNTQ0RTNGMzAw
MDUxM0YxMEUwQTlFNEU3AAoJEABRPxDgqeTnhBAP/iCNU2aU5UK4mtALfoFwH8GB
Jsd7XyISWPMvNABG8jYQH1BWq9f90QpnuVsGmBm8BIFpxR1jIQaYBF6QHxdaRGLv
nfOXbuIdpvTbbH7JMYkbZQzelaPdQIw6aOtKgoJ/4j7Hs97Bii4HpIzLhJKjp5HB
uotp7sXzWsS6MhmDW922X4b1I0HekfuMQe1K7xXeLSPkRYzYybR8HpaY11IqSQp8
eaZYZOtrO62XI4rzcNrUG4utDyVP50/VVAwauMTLY4evweVn8CwhMGQz08qXvQ4a
YjFqaLIsPYq49FBe4p23ih+zSiIUC1yfG8ihte9ZVVk5JdDAS4MVZhTEKU948eRT
H5Y9IDdovNdTVpif3dCBICH4NSP6R4U7Zt8yvyHe1eLblkbJDvsL4wYWUkU2YIbG
n5hlcwQwX7560bjaNczlvIY0MT46HQZj4Vr6nVMr6XIy7cBFRyQgCQHDMdMlluga
1kBmI32NBejcBEGmUN34lMC+1KGp0C++1DMeMSKP7D5KU3mwDY7nTdPxJLCx1H/f
YrBfotI/w7u6MWTFotuWinNjt+IZt4ZPDSQreH4QCmAoXrXptz5SFiWFZH1yO8OB
vPrhGzIDaTS0KPHg8P9X0ICBkHWT+/yehbUQGjIGv2vmCRpcrVG3NSkQPO0N+sJf
B0nBZO3faXeXMhD2Ibp0
=FdXz
-----END PGP SIGNATURE-----

--COjCLCtdVp4jrOpsl240HElpCKFDuVJmC--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?08cf61a1-d1ff-66e9-81e7-371bb47eec34>