Hello all.

 

I've noticed today a large number of shares that have been created on my server which weren't created by me. They all seem to be Unraid OS related folders. The access time for each of these seems to be regularly updating, which makes me think there is some kind of link to "actual" system files.

 

These seem to have started after I was troubleshooting the mover tuning plugin and realised I needed to reinstall it to get the 7.0.0 compatible version and re-ran the mover. The new mystery shares seem to mostly be on the same disk that most of my files moved to, so that makes me think the mover caused it. I have checked my container mounts and can't see anything that might have caused it there.

 

I've also today started getting 500 Internal Server Errors, but I cannot tell if this is linked or not. I moved docker bridging from macvlan to ipvlan (another job I've been meaning to get around to) as I've heard this can cause these errors, but have continued to have these after doing so. Reloaded nginx and php didn't fix these.

 

Below is a shot of some of the shares that have been created (crossed out shares are my manually created ones which are expected) and I can upload a diagnostics output, although this won't be comprehensive due to reboots I had to do to fix the 500 errors - the diagnotic tool from the command line didn't seem to do anything.

 

Hopefully someone will have encountered this before or be able to guide me on where to look further.

 

 

Thanks!

I did manage to grab the syslog-previous manually and found this log entry around the time I started getting the 500 errors:

 

nginx: 2025/04/07 16:00:12 [error] 14434#14434: *23911 FastCGI sent in stderr: "Unable to open primary script: /usr/local/emhttp/plugins/unassigned.devices.preclear/include/Preclear.php (No such file or directory)" while reading response header from upstream, client: 192.168.0.51, server: , request: "POST /plugins/unassigned.devices.preclear/include/Preclear.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm.sock:", host: "[HOSTNAME]:8080", referrer: "http://[HOSTNAME]:8080/Tools/Diagnostics"

 

I can't tell if this is a symptom or a cause, but looks like this may be crashing PHP-FPM and I'm not going to be using the plugin any time soon so I have removed it for now and will monitor.

All top-level folders will have a share automatically created, someone/something copied/created those folders on the array or a pool.

I'm sure something has created those folders, that's exactly what I'm trying to find out.

 

The shares being created and the sudden appearance of the nginx errors are almost certainly related. I've now seen a pattern that it's happening on the turn of the first hour after a reboot is done. It seems to be due to scripts that run every hour failing. This is a snippet from the syslog around the time the errors start:

 

crond[1992]: exit status 127 from user root /usr/local/emhttp/plugins/dynamix/scripts/monitor &> /dev/null

 

Now, that seems to be failing because the path doesn't exist. So I did some searching:

 

# find /mnt -type f -name 'monitor'
/mnt/disk4/scripts/monitor
/mnt/user0/scripts/monitor
/mnt/user/scripts/monitor

 

So not only have these shares been created, a number of system created files seem to have been moved to these folders.

 

Here's another example; the difference between the "agent" directory in the 2 locations:

 

~# ls -al /mnt/user/agents
total 60
drwxr-xr-x 1 root   root   310 Apr  8 18:00 ./
drwxrwxrwx 1 nobody users 4096 Apr  8 18:01 ../
-rw-r--r-- 1 root   root  1581 May 12  2024 Bark.xml
-rw-r--r-- 1 root   root  1200 May 12  2024 Boxcar.xml
-rw-r--r-- 1 root   root  7434 May 12  2024 Discord.xml
-rw-r--r-- 1 root   root  1271 May 12  2024 Gotify.xml
-rw-r--r-- 1 root   root  1346 May 12  2024 Prowl.xml
-rw-r--r-- 1 root   root  1305 Jul 10  2024 PushBits.xml
-rw-r--r-- 1 root   root  1082 Jul 10  2024 Pushbullet.xml
-rw-r--r-- 1 root   root  1205 May 12  2024 Pushover.xml
-rw-r--r-- 1 root   root  2653 May 12  2024 Pushplus.xml
-rw-r--r-- 1 root   root  1654 May 12  2024 ServerChan.xml
-rw-r--r-- 1 root   root  1134 May 12  2024 Slack.xml
-rw-r--r-- 1 root   root  2120 May 12  2024 Telegram.xml
-rw-r--r-- 1 root   root  1573 May 12  2024 ntfy.sh.xml

~# ls -al /boot/config/plugins/dynamix/notifications/agents
total 48
drwx------ 2 root root 16384 Oct  1  2018 ./
drwx------ 3 root root 16384 Oct  1  2018 ../
-rw------- 1 root root   500 Dec 11  2023 Pushover.sh

 

This pattern doesn't point to a simple misconfiguration of containers, scripts or whatever. This is like some kind of backup or update process has gone awry somewhere. Did I somehow misconfigure the new mover tuning plugin so badly that it did this, or could something else have caused it?

I recommend uninstalling Mover Tuning. It is often problematic, and I think many people who think they want that are just overthinking how cache should be used.

I have exactly the same issue, I think it is caused by the mover tuning logging, default location for the log files is /tmp which is for unraid in ram.

So I think what is happening is that ram is filling up causing the 500 errors. Try disabling logging or changing the the log location (in mover tuning settings)

@minty14 I've just noticed the same issue after using MoverTuning. I disabled it because it was the last change I made before I started getting ngnix errors. I only just went to my shares screen and also saw the same thing. I now need to identify which shares are safe to delete...

If anyone has a list of the folders created by MoverTuning, that would be helpful.