From owner-freebsd-hackers@freebsd.org Wed Dec 14 19:02:32 2016 Return-Path: Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 26938C804B0 for ; Wed, 14 Dec 2016 19:02:32 +0000 (UTC) (envelope-from dirkx@webweaving.org) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id 0FBB21ECB for ; Wed, 14 Dec 2016 19:02:32 +0000 (UTC) (envelope-from dirkx@webweaving.org) Received: by mailman.ysv.freebsd.org (Postfix) id 0F1FBC804AF; Wed, 14 Dec 2016 19:02:32 +0000 (UTC) Delivered-To: hackers@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 0EC9CC804AE for ; Wed, 14 Dec 2016 19:02:32 +0000 (UTC) (envelope-from dirkx@webweaving.org) Received: from weser.webweaving.org (weser.webweaving.org [148.251.234.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.webweaving.org", Issuer "RapidSSL CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id A45541EC7 for ; Wed, 14 Dec 2016 19:02:31 +0000 (UTC) (envelope-from dirkx@webweaving.org) Received: from beeb.leiden.webweaving.org (5ED06D14.cm-7-1b.dynamic.ziggo.nl [94.208.109.20]) (authenticated bits=0) by weser.webweaving.org (8.15.2/8.15.2) with ESMTPSA id uBEJ1CcP099747 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 14 Dec 2016 20:01:13 +0100 (CET) (envelope-from dirkx@webweaving.org) X-Authentication-Warning: weser.webweaving.org: Host 5ED06D14.cm-7-1b.dynamic.ziggo.nl [94.208.109.20] claimed to be beeb.leiden.webweaving.org Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Subject: Re: ZFS - directory entry From: Dirk-Willem van Gulik In-Reply-To: <20161214185154.GT61036@server.rulingia.com> Date: Wed, 14 Dec 2016 20:01:12 +0100 Cc: FreeBSD Hackers Content-Transfer-Encoding: quoted-printable Message-Id: <68290275-9C8D-4ACC-9E29-B6A7805512FD@webweaving.org> References: <20161214185154.GT61036@server.rulingia.com> To: Peter Jeremy X-Mailer: Apple Mail (2.3259) X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.4.3 (weser.webweaving.org [148.251.234.232]); Wed, 14 Dec 2016 20:01:13 +0100 (CET) X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 19:02:32 -0000 > On 14 Dec 2016, at 19:51, Peter Jeremy wrote: >=20 > On 2016-Dec-14 16:27:00 +0100, Dirk-Willem van Gulik = wrote: >> A rather odd directory entry (in /root, the home dir of root/toor) = appeared on a bog standard FreeBSD 10.2 (p18) lightly loaded machine = under ZFS during/post a backup: >>=20 >> $ ls -la /root | tail -q >> ---------- 1 root wheel 9223372036854775807 Jan 1 1970 = ?%+?kD?H???x,?5?Dh;*s!?h???jw??????\h?:????????``?13?@?????OA????????Puux?= ???>=20 >> OS and ZFS is installed with a bog standard sysinstall. =E2=80=98SMART=E2= =80=99 nor smartd have reported anything. nothing in dmesg, syslog of = boot log. Any suggestions as how to debug or get to the root of this ?=20= >>=20 >> And in particular - what is a risk of a reboot (to get a kernel with = debug, etc) causing the issue to =E2=80=98go away=E2=80=99 - and hence = stopping the forensic ? >=20 > Do you have ECC RAM? If not, it's possible this is an artifact of = some RAM > corruption, rather than on-disk corruption. No ECC (simple 4x8 Gbyte sticks; nothing on L2 and L3 either). > I'm surprised by the slow scrub, though they are very slow disks. You = might > like to use gstat or zpool iostat to see if one of the disks is slower = than > the others - indicating a possible problem with it. Perfectly balanced. Rocks steady last few hours according to per disk = graphs. We=E2=80=99ll see how it goes before rebooting (and if it is = indeed memory - that will I guess mask the issue until it appears = again). Thanks, Dw=