trurl

According to the diagnostics you posted earlier, your system share is on disk2. If Docker and/or VM Manager is enabled in Settings, system share has open files. Your domain share is also on the array.

Trying to read or write large amounts of data at the same time parity check or rebuild is happening will affect performance of reading or writing, and will affect performance of parity check or rebuild. That is simply due to disks needing to seek a lot as it tries to go from one part of the disks for accessing data, and another part of a disks for parity check or rebuild. Parity Check Tuning Plugin will allow you to schedule parity checks/rebuilds to work during idle time.

Will it crash if you do parity check while watching something?

What happens if you make it a Public share?

Is this a Public share?

Your drive assigments are config/super.dat and config/pools folder. Your docker templates are config/plugins/dockerMan/templates-user.

Attach Diagnostics ZIP to your NEXT post in this thread.

Rebuild starting from 0 is expected if you reboot.

My 10TB finished in 39:13:51

What do you get from command line with this? ls -lah /mnt/userand this ls -lah /mnt/user/<sharename>

Try Tools - New Permissions on the share in case something like that is the real problem.

Step 1 - preread Step 2 - clear Step 3 - write preclear signature Step 4 - verify preclear signature Step 5 - postread So you are doing 1 pass of all steps. Steps 3 and 4 don't take significant time. My 10TB is 51% done with postread.

You can edit your sig by clicking on your avatar/username in the upper right corner and selecting Account Settings. You can also enable viewing of sigs there. I can see yours and it says you are on Unraid 5.05

Rebuild will result in the same contents as the emulated disk. If you copied files to the emulated disk those files will be on the rebuild. But we can't really tell anything about your filesystems since those diagnostcs are without the array started in normal (not maintenance) mode. Start the array in normal mode and post new diagnostics.

Is syslog appearing there?

I just happen to be preclearing a new 10TB drive right now. Did you include the preread and postread phases? You don't really need those to get sectors reallocated, but it might still be good for testing. My 10TB preread finished in about 13 hours, but I expect the actual clear to take longer than that. And I am also doing postread.

You may need to attach a keyboard and monitor to troubleshoot networking.

Do you have an attached monitor and keyboard?

Post a SMART report for it

Nothing obvious in those diagnostics. Might be useful to install Fix Common Problems plugin.

Post a screenshot of those settings.

If the attack could actually access that I would expect it to do more than just deleting logs. If the attack could access Unraid OS it might be a good idea to restore it from your flash backup. And it would also mean that other things the VMs had no access to are also suspect. Do you have any dockers? Was your server accessible from outside your LAN?

Previous diagnostics shows user share Temp exists on multiple array disks. Could be empty on all though. Minimum Free for Temp is 188G but several disks have that much.