From owner-freebsd-questions@FreeBSD.ORG Sat Apr 28 06:09:44 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 545911065672 for ; Sat, 28 Apr 2012 06:09:44 +0000 (UTC) (envelope-from aimass@yabarana.com) Received: from mail-iy0-f182.google.com (mail-iy0-f182.google.com [209.85.210.182]) by mx1.freebsd.org (Postfix) with ESMTP id 172678FC1B for ; Sat, 28 Apr 2012 06:09:44 +0000 (UTC) Received: by iahk25 with SMTP id k25so2538116iah.13 for ; Fri, 27 Apr 2012 23:09:43 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:x-gm-message-state; bh=us6RWdGvW+T74V3z14tq5otawM3NrYVEEzQbar7VEJY=; b=RELXlQOZc7/YfrLTAQmDp5x6toWakyWwX48AZLjSntn54PJsZ0p9okFZ0iSUY6N1Ol vvcqcZxiO4X6Vvn0eQAq14kPR/LxNvUde8v5SvlMiyR2jNzfJz9vTQDTA6e2n69qfw6J X7C++pzA+hWaJYqA1obyvsMWkZEbRpyQbl1hIKHxFpZq3ixFeXkhkJD061VnFnBW5Uzv r5nD7NHsM19P+rBCEeJ7KkIGoxADJG4avS4u777qdB1EEOw2a/6XNnBA+k9KmVGYMOEy /33ksCmncXFN3T/51gVZSyYoIb48GJdgBDeUk5HahxZC61esWp/rxVjkFb2sBeGtEgGS DgDQ== MIME-Version: 1.0 Received: by 10.50.89.200 with SMTP id bq8mr4930534igb.45.1335593383678; Fri, 27 Apr 2012 23:09:43 -0700 (PDT) Received: by 10.231.74.138 with HTTP; Fri, 27 Apr 2012 23:09:43 -0700 (PDT) In-Reply-To: References: Date: Sat, 28 Apr 2012 02:09:43 -0400 Message-ID: From: Alejandro Imass To: Wojciech Puchar Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQk+TjjXojBz189LsAqJS5TNltwZGRec3qjfhLTCsELY5o2pQwOk6jkpuLyKduDEZoODyMjI Cc: FreeBSD Questions Subject: Re: UFS Crash and directories now missing X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Apr 2012 06:09:44 -0000 On Sat, Apr 28, 2012 at 1:43 AM, Wojciech Puchar wrote: >> >> All the jails wound up in the /usr/local/etc/apache22 of the only >> surviving jail which is the http proxy to all the other jails. >> >> Right before the server crashed I noticed MySQL at 100% o several CPUs >> and the server was on it's knees, so I'm wondering.... was this an >> attack? is it possible that Apache or MySQL moved the files?? >> >> I mean the jails are there, I'm even backing them up right now.... but >> how did these directories move here????? >> >> Anybody has ANY logical explanation??? >> > 99% - someone did moved them. > 1% - hardware problem possibly memory. without this there is no way for > directory to be "accidentally" moved I somewhat agree, but it wasn't a person. I am the only administrator, the only one with root access. The jails were effectively moved to the /usr/local/etc/apache22 of the single that survived at the top level. I'm thinking something between mount, EzJail, the journal and the way MySQL created a great deal of head contention, so something must have gotten corrupted at the directory level like you state, but the strange part is no _data_ corruption as such, because I was able to physically archive the jails, move them to the correct directory and archived them all with ezjail-admin to a different disk. I was thinking of formatting the jails drive, but after all this disk activity and no errors, and everything booted up correctly, I am not so sure now that it's needed it.