danioj

I don't think it's a good idea for a plugin to access the Internet to connect to an SFTP server. I'm also not comfortable that I know enough to do it securely. For the time being, I feel that UD is accomplishing its intended goals and won't be adding any new features. Fair enough, I can understand those arguments.

Dan, do you think there is any chance of adding support for being able to mount an SFTP location?

Yeah, sorry, just updated my last post. I've been able to work around this by forwarding the same port through both my router and the new modem. Thanks! I am glad that you have seemingly solved your issue - BUT - is there any issue why you are running NAT (Network Address Translation) on two connected devices? Typically with NAT only the router needs to have a public IP address (also called Gateway, usually a DSL or Cable Modem). All devices behind the NAT router have private IP addresses - usually starting with 192.168 or 10 etc. These addresses are of course only valid within the router network. The most common setup is simple and is a network with one gateway (say DSL or Cable modem). The gateway has a public (WAN) IP address and does NAT. All computers connected to this gateway get assigned a private IP address (as described above). The gateway takes care routing the data from / to computers connected to it. To make a computer connected to gateway accessible from Internet a port forwarding setting is required. This scenario of course represents a single level of NAT (just one router on network that does network address translation) and that in most cases is what you want. As johnathanm indicates you have Double NAT. Double NAT is a scenario where multiple routers on network are doing network address translation. Common example is the one you have which is a Cable or DSL modem, to which a Wi-Fi router is connected. Both modem and router have NAT enabled. Computers on the network are typically only connected to the Wi-Fi router. As you have found, even if port forwarding is setup on Wi-Fi router, the computer is not accessible from the Internet, because the WiFi router itself doesn't have public IP address. It has a private IP address within the network of DSL/Cable modem. Assuming this is not by design, there are multiple ways to resolve this. So with regards to your setup I will make the assumptions that: - You have the typical problematic setup in a modem (DSL, Cable, Fiber, etc) and a Wireless router connected to the modem; - Both the wireless router and the modem have web administration interface, each can be configured with a web browser and you have the connection details. As for solutions (and you have already come across the first one): 1 - Port forward between the devices - NOT RECOMMENDED Note that all this does is route the traffic and get a specific application (for the ports being forwarded) to work. Note that this does NOT eliminate Double-NAT. Unless you have a specific need for Double-NAT this is not recommended. There are network related reasons BUT the practical one is that you will have to do this for EVERY port you want to forward making what should be a simple and manageable thing - much harder. 2- Put the wireless router in the modem's DMZ (if supported) - NOT RECOMMENDED A DMZ (demilitarized zone) is a common feature of a router that allows you to chose one client to which all traffic is forwarded. If your modem supports DMZ you could do this: - Find out the WAN address of the wireless router. For this you might need to log in to the WiFi router admin interface and look at the Status page (most router's have status pages which show relevant information about the WAN connection). - Log in to the modem web administration interface, find the DMZ settings and put the WiFi router's IP WAN address there. Note that (Like option 1) this does NOT eliminate Double-NAT. Unless you have a specific need for Double-NAT this is not recommended. 3 - Put the Modem in "bridged mode" - RECOMMENDED Bridged mode means that NAT and DHCP functions on it will be disabled. Some routers call it "bridged mode", some simply allow you to disable NAT and DHCP. Unfortunately some devices simply don't support bridged mode at all. If the modem doesn't support this - you "could" disable it on the router and run NAT on the modem. I will leave you to your manufacturers instructions for doing this - but the principals are the same (in that it requires logging on to the management interface of the device and enabling (or disabling) the appropriate option) as option 2. This is the BEST option IMHO. If you manage to switch the modem to bridged mode, all port forwarding (along with all your other network config) needs to be configured in one place, on the router. You might not have needed all that but I still enjoyed sourcing / writing it! 8

You should not be compiling ANYTHING on your unRAID system. There is an App available for unRAID to do this for you. I am at work so I cannot check "Community Applications" aka "Apps" to see if this container is released and supported but here is the earlier thread: https://lime-technology.com/forum/index.php?topic=34876.0

Thanks for this danioj. Other than being overeager with my port-forwarding, it was the step to download the certificate that I couldn't figure out.. I've followed your directions now, however when I try to log in to the VPN when I'm not on my home network from the OpenVPN app on my phone the connection just times out. Do you have any idea how I might fix this? I've included part of the OpenVPN log below. 2016-03-04 22:02:49 ----- OpenVPN Start ----- OpenVPN core 3.0 ios arm64 64-bit 2016-03-04 22:02:49 UNUSED OPTIONS 0 [setenv] [FORWARD_COMPATIBLE] [1] 3 [nobind] 10 [sndbuf] [100000] 11 [rcvbuf] [100000] 14 [verb] [3] 15 [setenv] [PUSH_PEER_INFO] 23 [CLI_PREF_ALLOW_WEB_IMPORT] [True] 24 [CLI_PREF_ENABLE_CONNECT] [True] 25 [CLI_PREF_ENABLE__PROXY] [True] 26 [WSHOST] [vulf.ddns.net:943] 27 [WEB_CA_BUNDLE] [-----BEGIN CERTIFICATE----- MIIDBDCCAeygAwIBAgIEVtfU8zANBgkqhkiG...] 28 [iS_OPENVPN_WEB_CA] [1] 29 [ORGANIZATION] [OpenVPN Technologies, Inc.] 2016-03-04 22:02:49 LZO-ASYM init swap=0 asym=1 2016-03-04 22:02:49 Comp-stub init swap=0 2016-03-04 22:02:49 EVENT: RESOLVE 2016-03-04 22:02:49 Contacting 192.168.0.10:1194 via UDP 2016-03-04 22:02:49 EVENT: WAIT 2016-03-04 22:02:49 SetTunnelSocket returned 1 2016-03-04 22:02:49 Connecting to vulf.ddns.net:1194 (192.168.0.10) via UDPv4 2016-03-04 22:02:59 Server poll timeout, trying next remote entry... 2016-03-04 22:02:59 EVENT: RECONNECTING 2016-03-04 22:02:59 LZO-ASYM init swap=0 asym=1 2016-03-04 22:02:59 Comp-stub init swap=0 2016-03-04 22:02:59 EVENT: RESOLVE 2016-03-04 22:02:59 Contacting 192.168.0.10:1194 via UDP 2016-03-04 22:02:59 EVENT: WAIT 2016-03-04 22:02:59 SetTunnelSocket returned 1 2016-03-04 22:02:59 Connecting to vulf.ddns.net:1194 (192.168.0.10) via UDPv4 2016-03-04 22:03:09 Server poll timeout, trying next remote entry... 2016-03-04 22:03:09 EVENT: RECONNECTING 2016-03-04 22:03:09 LZO-ASYM init swap=0 asym=1 2016-03-04 22:03:09 Comp-stub init swap=0 2016-03-04 22:03:09 EVENT: RESOLVE 2016-03-04 22:03:09 Contacting 192.168.0.10:1194 via UDP 2016-03-04 22:03:09 EVENT: WAIT 2016-03-04 22:03:09 SetTunnelSocket returned 1 2016-03-04 22:03:09 Connecting to vulf.ddns.net:1194 (192.168.0.10) via UDPv4 2016-03-04 22:03:19 Server poll timeout, trying next remote entry... 2016-03-04 22:03:19 EVENT: RECONNECTING 2016-03-04 22:03:19 LZO-ASYM init swap=0 asym=1 2016-03-04 22:03:19 Comp-stub init swap=0 2016-03-04 22:03:19 EVENT: RESOLVE 2016-03-04 22:03:19 Contacting 192.168.0.10:1194 via UDP 2016-03-04 22:03:19 EVENT: WAIT 2016-03-04 22:03:19 SetTunnelSocket returned 1 2016-03-04 22:03:19 Connecting to vulf.ddns.net:1194 (192.168.0.10) via UDPv4 2016-03-04 22:03:29 Server poll timeout, trying next remote entry... 2016-03-04 22:03:29 EVENT: RECONNECTING 2016-03-04 22:03:29 LZO-ASYM init swap=0 asym=1 2016-03-04 22:03:29 Comp-stub init swap=0 2016-03-04 22:03:29 EVENT: RESOLVE 2016-03-04 22:03:29 Contacting 192.168.0.10:1194 via UDP 2016-03-04 22:03:29 EVENT: WAIT 2016-03-04 22:03:29 SetTunnelSocket returned 1 2016-03-04 22:03:29 Connecting to vulf.ddns.net:1194 (192.168.0.10) via UDPv4 2016-03-04 22:03:39 Server poll timeout, trying next remote entry... 2016-03-04 22:03:39 EVENT: RECONNECTING 2016-03-04 22:03:39 LZO-ASYM init swap=0 asym=1 2016-03-04 22:03:39 Comp-stub init swap=0 2016-03-04 22:03:39 EVENT: RESOLVE 2016-03-04 22:03:39 Contacting 192.168.0.10:1194 via UDP 2016-03-04 22:03:39 EVENT: WAIT 2016-03-04 22:03:39 SetTunnelSocket returned 1 2016-03-04 22:03:39 Connecting to vulf.ddns.net:1194 (192.168.0.10) via UDPv4 2016-03-04 22:03:49 EVENT: CONNECTION_TIMEOUT [ERR] 2016-03-04 22:03:49 EVENT: DISCONNECTED 2016-03-04 22:03:49 Raw stats on disconnect: BYTES_OUT : 1260 PACKETS_OUT : 30 CONNECTION_TIMEOUT : 1 N_RECONNECT : 5 2016-03-04 22:03:49 Performance stats on disconnect: CPU usage (microseconds): 43470 Network bytes per CPU second: 28985 Tunnel bytes per CPU second: 0 2016-03-04 22:03:49 EVENT: DISCONNECT_PENDING 2016-03-04 22:03:49 ----- OpenVPN Stop ----- I'm taking a guess that it is this: vulf.ddns.net:1194 (192.168.0.10) It is trying to connect to a LAN IP address. Try and disconnecting your Phone from the Wireless to being with and then trying lofting in via 3G/4G. Interestingly I just tried to ping vulf.ddns.net and it could not resolve the host. As a means of debugging you could just create a profile with your external IP address and see if at least it works with that.

What issues are you reffering to?

Firstly I wouldn't be opening ports up on my router until my configuration was complete. I also wouldn't be exposing my Admin/Connect web pages to the internet. In the main, default settings for this Docker Container are fine. It works pretty much as is once you understand that minimal playing is required and what everything does. Here is what I did: - Installed OpenVPN-AS Docker. - Changed Admin Password - Created New User - Changed New User Password - Log into Admin Web GUI on port 943 using admin credentials - Selected Server Network Settings - Changed Hostname to my domain name (this is optional - I connect via a domain name not an IP Address and I want to to be reflected in the certificate files when they get generated). - Changed Protocol to UDP only - Changed UDP port to 1194 - UnderClient Web Server I checked Use the same address and port as the Admin Web Server (This means that the Admin and Connect UI's are accessible from the same port) - Save Settings - Goto User Permissions - Create a new user to match the one that you created earlier on the Command Line - Check Admin (If you want to BUT there is no reason why not - you're not going to allow access to the Admin or Connect GUI's outside the LAN anyway) - Check Allow Auto-Login - Check Require user permissions record for VPN access - Save Settings - Click Apply on Server (if the option appears - and it should) - Logout of Admin Web GUI - Log into Connect Web GUI on port 943 using your new user credentials - Click Connection profiles can be downloaded for: Yourself (user-locked profile) link - A .ovpn (containing required certificates to securely auto login from a client) file will be downloaded to your PC - Log out of Connect Web GUI This is what I did to enable the Profile on my iPhone: - E-mailed the .ovpn to a secure email account accessible on my iPhone - Installed the OPenVPN iPhone app from the App Store - Went into my e-mail client and opened the .ovpn file with the newly installed OpenVPN iPhone app - When the file opens it prompts you to save the config. Click Yes. - Deleted .ovpn file from my email client (and server) and saved a copy of it on my Array for using later. On OSX the procedure is similar except you can use a nice program called Tunnelblick from the App Store. Once things are loaded, then: - Open your router (no need for opening another ports if you have followed my instructions) Web GUI and Open and forward port 1194 to your unRAID Server. - Try and Login from one of your clients. If all is well, and the few times I have set this up it has been - your VPN connection will start up and you can access your LAN side machines as if your were on the LAN itself. Note: You can log in from any and as many clients as you like. The license is per user NOT per connection.

I just tried 15 dry-runs. None of them moved anything.

Doesn't Rsync verify copies without the need for an additional switch anyway?

I agree it is strange - and I might be wrong in my assessment - but I don't think I am. Without asking the Emby team for confirmation (which I could do via their forum if you guys want me to) I think it more likely they pushed out an update. Container got updated. Emby team quickly found something minor was wrong and pushed out another (which of course is not common) to fix.

Right, I see what you guys are reffering to: Version 3.0.5871.0 This is not an issue with the docker container though IMHO. Some Docker Containers (like the ones supported by the linuxserver.io group) are designed to always run the latest version and when you start them they pull the latest files from the selected repositories when you start/restart them. This is not the case with Emby I think. Each time a new version is released it appears the container needs to be updated and pushed out for that new version. What it looks like is the Emby community has pushed out an update and there hasn't been a corresponding update to the Container yet. This can happen if the release group is very frequent with releases. Plus it's a dependency on the maintainer of the Container and I don't think we can expect instant updates. I wouldn't worry though. Unless you have a specific issue that the new release is going to address then relax. An update to this container to match the latest version will get pushed out quite soon. It's usually very quick in my experience.

- Go to your unRAID Web GUI. - Click on "Docker" Tab. - Click on "Check For Updates" Button at the bottom of the "Docker Containers" section of the web page. - In the third column (Version) of the row containing Emby, "up-to-date" will have changed to "update ready" and will now be a link. - Click "update ready" link. - A popup will appear asking for confirmation that you want to execute the update. - Click "Just do it!" button. - A dialog box named "Updating Container" will appear to show you the progress of the update. Just wait and let it run. - When finished (It can take a while as the updates can be a couple of hundred MB) you will see a statement in the dialog box saying "The command finished successfully!" and a button called "done" (you "might" have to scroll down slightly) will appear at the bottom of the dialog. - Click the "done" button and the dialog will dissapear. The Emby Docker container will restart and apply the new config. Done

OK - I don't know what went down with the Cache Pool BUT I do know I have fixed it. I remembered that at the weekend I "tried" to install an ATI Video Card to the Server to demonstrate something to a "Friend" BUT it wouldn't fit with my configuration. I jacked a few of the data cables out of the board to see if it would fit AND I made a mental note that I had not put them into the exact same ports. I decided it didn't matter as I remembered that unRAID didn't care about this like it did in previous versions. So in essence I HAD this: Cache Disk 1 was sdb Cache Disk 2 was sac Now I have: Cache Disk 1 is sdc Cache Disk 2 is sdd Like I mention I didn't feel it was an issue. Clearly I was wrong AS unfortunately this issue coincides (as I keep daily logs) with me making these changes. There is no other Catalyst. I don't know what the connection is here - maybe something to do with the way BTRFS creates the RAID-1 array and keeps track of it. Who knows. Anyway, to fix it, I stopped all applications that would write to the Array. Moved ALL data from the Cache device using the mover. Stopped the Array. Removed both Cache Disks from the Array Cache Slots. Mounted them via Unassigned Devices and removed their partitions. Unmounted them. Added them back into the Array Cache Slots. Started The Array. When Prompted to Format to BTRFS, I did. The RAID-1 Array was successful set up again. Label: none uuid: e699fcb6-1360-4fb9-9ec9-7768cce05986 Total devices 2 FS bytes used 640.00KiB devid 1 size 232.89GiB used 3.03GiB path /dev/sdc1 devid 2 size 232.89GiB used 3.03GiB path /dev/sdd1 btrfs-progs v4.1.2 btrfs filesystem df: Data, RAID1: total=1.00GiB, used=512.00KiB System, RAID1: total=32.00MiB, used=16.00KiB Metadata, RAID1: total=2.00GiB, used=112.00KiB GlobalReserve, single: total=16.00MiB, used=0.00B Then when I ran fstrim from the command line: root@main:~# /sbin/fstrim -v /mnt/cache /mnt/cache: 2233237504 bytes were trimmed All seems to be working again. Weird, but resolved.

I have noticed something odd with the TRIM Plugin. Recently I have noticed that the output of the Plugin is showing: Mar 3 00:10:01 main logger: /mnt/cache: 0 bytes were trimmed My understanding of the way fstrim works with BTRFS is that this should never be the case that it shows 0 bytes. There is nothing in the syslog but this. It was working a only a matter of days ago: Feb 25 00:10:01 main logger: /mnt/cache: 1946124288 bytes were trimmed As you can see I have it set to run every night at 12:10. Not sure how to debug this, can anyone help?

Thanks danioj, that's very helpful. No worries. Let me know if you need any more help. Feel free to PM if you don't want to clog the thread.

Post a screenshot of your Docker Container Page. Just Click "Docker" Tab and take a screenshot.

If you're going to port 8080 (which is the default port for Sabnzbd by linuxserver.io) and it is coming up with Guacamole (which is another docker for a kind of remote access) then you probably have a port conflict. I have just checked the Guacamole container for you and I am right. The Default port for Guacamole is 8080 too. What you need to do is go into the settings of Guacamole and change to a port that no other Docker uses. Maybe use 8030 - AFAIK that is not a port used by any common Docker Application. Also note the following instructions in the Guacamole Docker Container Description: Just change the port number in the Port Mappings Section of the Guacamole Docker section and click apply. Port 8080 should then be released. Then go to Sabnzbd Docker Icon (don't go into Settings of the docker), Click on the Sabnzbd Icon and in the sub menu that appears Click Restart. Sabnzbd should then restart and bind itself to port 8080. Then all should be well.

Under the "Docker" Tab there is a list of ALL your installed Dockers by ROW. To the far right of each ROW in the last COLUMN named "Log" there is an icon (see attached image). Click on that icon

Be Patient. The WebUI isn't usually available straight away after the Docker Container starts. That is because it checks the included repos for latest versions first and this can take a while (especially on slower connections or if you're downloading something). Check the log of the docker container, here is an example of the log of what it does on startup BEFORE the Application is started and the WEBGUI available: ------------------------------------- _ _ _ | |___| (_) ___ | / __| | |/ _ \ | \__ \ | | (_) | |_|___/ |_|\___/ |_| Brought to you by linuxserver.io We do accept donations at: https://www.linuxserver.io/donations ------------------------------------- GID/UID ------------------------------------- User uid: 99 User gid: 100 ------------------------------------- finding fastest mirror ------------------------------------- _ _ _ | |___| (_) ___ | / __| | |/ _ \ | \__ \ | | (_) | |_|___/ |_|\___/ |_| Brought to you by linuxserver.io We do accept donations at: https://www.linuxserver.io/donations ------------------------------------- GID/UID ------------------------------------- User uid: 99 User gid: 100 ------------------------------------- finding fastest mirror 1. mirror.internode.on.net (current) Latency: 11 ms Org: Internode Status: Up to date Speed: 1 Gbps 2. ubuntu.mirror.digitalpacific.com.au Latency: 13 ms Org: Digital Pacific Status: Up to date Speed: 1 Gbps 3. mirror.overthewire.com.au Latency: 23 ms Org: Over The Wire Status: Up to date Speed: 1 Gbps We are now refreshing packages from apt repositories, this *may* take a while Ign http://mirror.internode.on.net trusty InRelease Get:1 http://mirror.internode.on.net trusty-updates InRelease [65.9 kB] Get:2 http://mirror.internode.on.net trusty-security InRelease [65.9 kB] Hit http://mirror.internode.on.net trusty Release.gpg Get:3 http://mirror.internode.on.net trusty-updates/main Sources [326 kB] Get:4 http://mirror.internode.on.net trusty-updates/restricted Sources [5,217 B] Get:5 http://mirror.internode.on.net trusty-updates/universe Sources [189 kB] Get:6 http://mirror.internode.on.net trusty-updates/multiverse Sources [5,498 B] Get:7 http://mirror.internode.on.net trusty-updates/main amd64 Packages [897 kB] Hit http://ppa.launchpad.net trusty InRelease Get:8 http://mirror.internode.on.net trusty-updates/restricted amd64 Packages [23.5 kB] Get:9 http://mirror.internode.on.net trusty-updates/universe amd64 Packages [439 kB] Get:10 http://mirror.internode.on.net trusty-updates/multiverse amd64 Packages [14.3 kB] Get:11 http://mirror.internode.on.net trusty-security/main Sources [132 kB] Hit http://ppa.launchpad.net trusty/main amd64 Packages Get:12 http://mirror.internode.on.net trusty-security/restricted Sources [3,920 B] Get:13 http://mirror.internode.on.net trusty-security/universe Sources [38.2 kB] Get:14 http://mirror.internode.on.net trusty-security/multiverse Sources [2,548 B] Get:15 http://mirror.internode.on.net trusty-security/main amd64 Packages [530 kB] Get:16 http://mirror.internode.on.net trusty-security/restricted amd64 Packages [20.2 kB] Get:17 http://mirror.internode.on.net trusty-security/universe amd64 Packages [161 kB] Get:18 http://mirror.internode.on.net trusty-security/multiverse amd64 Packages [4,852 B] Hit http://mirror.internode.on.net trusty Release Hit http://mirror.internode.on.net trusty/main Sources Hit http://mirror.internode.on.net trusty/restricted Sources Hit http://mirror.internode.on.net trusty/universe Sources Hit http://mirror.internode.on.net trusty/multiverse Sources Hit http://mirror.internode.on.net trusty/main amd64 Packages Hit http://mirror.internode.on.net trusty/restricted amd64 Packages Hit http://mirror.internode.on.net trusty/universe amd64 Packages Hit http://mirror.internode.on.net trusty/multiverse amd64 Packages Fetched 2,924 kB in 2s (1,078 kB/s) Reading package lists... Mar 3 01:01:45 38597d0fd451 syslog-ng[55]: syslog-ng starting up; version='3.5.3' The last line: Mar 3 01:01:45 38597d0fd451 syslog-ng[55]: syslog-ng starting up; version='3.5.3' Indicates that the Docker is up and running and the WEBUI should be available on the specified port in the Docker config.

No worries, see the commands below and the output of the commands under them. ls -al /mnt root@main:/# ls -al /mnt total 32 drwxr-xr-x 12 root root 240 Feb 28 18:54 ./ drwxrwxrwx 18 root root 380 Sep 28 2012 ../ drwxrwxrwx 1 nobody users 6 Mar 2 22:23 cache/ drwxrwxrwx 3 nobody users 17 Mar 2 00:38 disk1/ drwxrwxrwx 3 nobody users 17 Dec 27 14:07 disk2/ drwxrwxrwx 3 nobody users 17 May 21 2015 disk3/ drwxrwxrwx 3 nobody users 17 May 21 2015 disk4/ drwxrwxrwx 3 nobody users 53 Jun 15 2015 disk5/ drwxrwxrwx 3 nobody users 17 May 21 2015 disk6/ drwxrwxrwx 4 root root 80 Feb 28 18:54 disks/ drwxrwxrwx 1 nobody users 6 Mar 2 22:23 user/ drwxrwxrwx 1 nobody users 17 Mar 2 00:38 user0/ grep -i 'name\|type' /var/local/emhttp/disks.ini root@main:/# grep -i 'name\|type' /var/local/emhttp/disks.ini name="parity" type="Parity" name="disk1" type="Data" fsType="xfs" name="disk2" type="Data" fsType="xfs" name="disk3" type="Data" fsType="xfs" name="disk4" type="Data" fsType="xfs" name="disk5" type="Data" fsType="xfs" name="disk6" type="Data" fsType="xfs" name="cache" type="Cache" fsType="btrfs" name="cache2" type="Cache" fsType="btrfs" name="flash" type="Flash" fsType="vfat" I think it is worth noting that cache"2" could well be cache"n" in v6. You could feasibly AFAIK have as many cache devices in a pool as your available slots in your unRAID version allow. That being said, As Far As I Can Tell you always still write to "/mnt/cache" when there is a pool of disks in a Cache Pool and unRAID and the BTRFS config manage the writing to the disks accross the array. Also disk "cache" (or the first disk in the Array) and NOT cache"n" appears to have the data for displaying purposes. See GUI for example:

You're a machine .... and you're doing a great job supporting this plugin!

I have a question with regards to the new Cache drive functionality. With many of us using Cache Pools here is what mine shows: Clearly it shows disk 1 with the information and disk 2 as the mirror BUT without information. Is there the possibility of creating issues here. Say a user movies data to Cache Disk 2? What would happen? I am not saying I would DO it but it is possible isn't it? Just speculating ...

Oooo nice feature, thank you. Quick question, can you write to it or is it read only? Read only. Roger. Thanks.

Oooo nice feature, thank you. Quick question, can you write to it or is it read only?

There is no relation between Build/Export commands and file corruption. This might have happened due to the changes made in bunker. Did you re-apply the settings or stop/start the service? This will force the latest version of bunker to be used. Reapplying the settings didn't work so I just rebooted. Checked the Files again, no file corruption or mismatch. All working now.