From owner-freebsd-questions@FreeBSD.ORG Sat Apr 28 02:33:48 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D36CB106566C for ; Sat, 28 Apr 2012 02:33:48 +0000 (UTC) (envelope-from aimass@yabarana.com) Received: from mail-iy0-f182.google.com (mail-iy0-f182.google.com [209.85.210.182]) by mx1.freebsd.org (Postfix) with ESMTP id 9A4BE8FC0A for ; Sat, 28 Apr 2012 02:33:48 +0000 (UTC) Received: by iahk25 with SMTP id k25so2352352iah.13 for ; Fri, 27 Apr 2012 19:33:48 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:x-gm-message-state; bh=xOtADDpg9C4x5YrjF4CxO48Fp9fN3g9FKt3B8pcqbNs=; b=hgxsNyQGQisqWExHVMwZSqOSpHiHXIMO5E2WtJpeMB9NBos0q8BAKFyvyDMngpe1Nk VqrGW8ntZtDkjwd94EsvdOyB6CW266Kt8thgy6+gsX4wg2AN5ELEFk487/TzJ0VIEOLs XBoKp7ik6vU/lLmKn4hWhjbjPKYI39+kibNadLAvPOeaHin9Umcygkq+9AdfpeTCN9F2 auv/9FOZ4IKXUwh8Q9CeuMIyf2bdRJrSYsP+C8bOGZOV6+nsnZv8qfggatEaP1zN7ZlV KM/JB4ksUnafZDWr1QEzVEng8UbACJoQiFttPut/sw1668GXVaSPCAMsuNHklGfbx6bf WEvw== MIME-Version: 1.0 Received: by 10.50.88.199 with SMTP id bi7mr4469249igb.26.1335580427989; Fri, 27 Apr 2012 19:33:47 -0700 (PDT) Received: by 10.231.74.138 with HTTP; Fri, 27 Apr 2012 19:33:47 -0700 (PDT) In-Reply-To: References: Date: Fri, 27 Apr 2012 22:33:47 -0400 Message-ID: From: Alejandro Imass To: FreeBSD Questions Content-Type: text/plain; charset=ISO-8859-1 X-Gm-Message-State: ALoCoQnKBYRLRmcjnMCi3afvzU/hyQ6t2N31LGQB6Kr9yUp6OB1wZvZYI3GXjeqvGWYtsbYWcDWa Subject: Re: UFS Crash and directories now missing X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Apr 2012 02:33:48 -0000 On Fri, Apr 27, 2012 at 7:52 PM, Alejandro Imass wrote: > Hi folks, > > We had a server crash and required a hard reboot. The system is on one > disk and another disc mounts /usr/jails and everything runs in jails, > pristine base system, and the base system is working perfectly. > > The second volume, the one with the jails mounted but every jail > directory disappeared except one. df still shows the data being used > so I'm guessing it's a logical error in the directory structure or > something. I unmounted the drive and ran fsck and reported no > problems. df shows the data being use so where is the data?? > OK, so here is an update, maybe someone has some clue here.... All the jails wound up in the /usr/local/etc/apache22 of the only surviving jail which is the http proxy to all the other jails. Right before the server crashed I noticed MySQL at 100% o several CPUs and the server was on it's knees, so I'm wondering.... was this an attack? is it possible that Apache or MySQL moved the files?? I mean the jails are there, I'm even backing them up right now.... but how did these directories move here????? Anybody has ANY logical explanation??? Thanks, -- Alejandro Imass > This is FreeBSD 8.2 updated, patched etc. The volume was UFS + Journal > > Any help is GREATLY appreciated! > > Thanks! > > -- > Alejandro Imass