From owner-freebsd-questions@FreeBSD.ORG  Sun Apr 29 17:16:22 2012
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 732511065A17
	for <freebsd-questions@freebsd.org>;
	Sun, 29 Apr 2012 17:16:22 +0000 (UTC)
	(envelope-from freebsd-questions@m.gmane.org)
Received: from plane.gmane.org (plane.gmane.org [80.91.229.3])
	by mx1.freebsd.org (Postfix) with ESMTP id 260538FC0A
	for <freebsd-questions@freebsd.org>;
	Sun, 29 Apr 2012 17:16:22 +0000 (UTC)
Received: from list by plane.gmane.org with local (Exim 4.69)
	(envelope-from <freebsd-questions@m.gmane.org>) id 1SOXjI-0002kE-R4
	for freebsd-questions@freebsd.org; Sun, 29 Apr 2012 19:16:12 +0200
Received: from np-19-75.prenet.pl ([np-19-75.prenet.pl])
	by main.gmane.org with esmtp (Gmexim 0.1 (Debian))
	id 1AlnuQ-0007hv-00
	for <freebsd-questions@freebsd.org>; Sun, 29 Apr 2012 19:16:12 +0200
Received: from jb.1234abcd by np-19-75.prenet.pl with local (Gmexim 0.1
	(Debian)) id 1AlnuQ-0007hv-00
	for <freebsd-questions@freebsd.org>; Sun, 29 Apr 2012 19:16:12 +0200
X-Injected-Via-Gmane: http://gmane.org/
To: freebsd-questions@freebsd.org
From: jb <jb.1234abcd@gmail.com>
Date: Sun, 29 Apr 2012 17:15:57 +0000 (UTC)
Lines: 19
Message-ID: <loom.20120429T190931-325@post.gmane.org>
References: <201204281731.q3SHVaiM061997@mail.r-bonomi.com>
	<CAHieY7Tcv+o-KbmLtPVHWXSphJX7b5f0QMO46yM-DOju4S9S7Q@mail.gmail.com>
	<20120428200116.b2f5820e.freebsd@edvax.de>
	<CAHieY7TpWsCbm8LZFMboWHgXJ2M79TbcK7Jse3=MoVUR2XB5Ow@mail.gmail.com>
	<4f9ced3a.f7WBDlsMkhxvy+eF%perryh@pluto.rain.com>
	<20120429103740.aa7df743.freebsd@edvax.de>
	<CAHieY7QCpV0Tz-mJHyNuObnF+N+nAXGpnxr4D1f8s_2E_No+Hw@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Complaints-To: usenet@dough.gmane.org
X-Gmane-NNTP-Posting-Host: sea.gmane.org
User-Agent: Loom/3.14 (http://gmane.org/)
X-Loom-IP: 79.139.19.75 (Mozilla/5.0 (X11; FreeBSD i386;
	rv:10.0.2) Gecko/20100101 Firefox/10.0.2)
Subject: Re: UFS Crash and directories now missing
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 29 Apr 2012 17:16:22 -0000

Alejandro Imass <ait <at> p2ee.org> writes:

> ... 
> And there was a log of a couple of ftp connections the same day this
> happened, the ONLY 3 messages before the reboot at about 6 pm and they
> were NOT from any of our customers. Here are the log entries:
> 
> Apr 27 05:54:37 nune ftp.proxy[2726]: connected to client:
> host-46-50-183-5.bbcustomer.zsttk.net, interface= 207.158.52.74:21
> Apr 27 05:54:37 nune ftp.proxy[2726]: info: monitor mode: off, ccp: <unset>
> Apr 27 05:54:38 nune ftp.proxy[2726]: -ERR: missing hostname
> Apr 27 18:55:42 nune syslogd: kernel boot file is /boot/kernel/kernel
> ...

What you should do right now is to get some recent general or security cd/dvd
with chkrootkit and rkhunter and run them from that external read-only media.  
I would also suggest that you look over config files of all packages involved.
jb