Hello,

I am relatively new to the world of Unraid - and I have found myself in some trouble. For the first month or so, the machine was running flawlessly without any issues.

Recently though, it has started crashing with below noticed:

1. UI becomes unresponsive (local / remote)

2. Cloudflare tunnel (Docker container) stops working for all paths (all containers)

3. Plex (container) remains working on local network ; not remotely (i gather due to Cloudflare)

After a hard restart, all will be working well again for a time (no trend, tendency etc.) before locking up agian.

I had temperature spikes under suspicion especially when Plex scan for intros etc. so I have switched all background tasks off - but still having the same issue.

I have attached the diagnostic pack, and hope anyone can point me in the right direction.

Note: I am currently away and not able to connect using SSH.

Hardware - Orico CF1000 NAS.

Cheers,

Casper - New to Unraid.

cf1000-diagnostics-20260207-1409.zip

Edited February 7Feb 7 by CasperOe88

Turn off logging for this plugin:

fanctrlplus.plg - 1.3.3  (Up to date)

Have you done memtest recently?

Setup Syslog Server.

Thank you @trurl - this is what I have in the settings for the fanctrl plugin - can't seem to turn off logs for this:

1. As for syslog server, already activated with copy being saved on the cache drive.

2. As for memtest, I have not run one yet as the NAS is quite new (got it one month ago).

I would run the memtest if I had access to the server just now, sadly, I am away traveling working remotely for the next couple of months.

Do you suspect it is a RAM issue?

Most recent save of syslog
syslog-previous.txt

22 minutes ago, CasperOe88 said:

As for syslog server, already activated with copy being saved on the cache drive.

syslog-previous is not those logs. You have to get them from the share you told it to save them on.

Post a screenshot of your syslog server settings page.

3 minutes ago, trurl said:

syslog-previous is not those logs. You have to get them from the share you told it to save them on.

Post a screenshot of your syslog server settings page.

Oh really? Sorry, thought that was the one :-) Here you go..

Remote log set to the IP of my server with 'Mirror to flash' being enabled.

I don't presently have another PC in the house it can mirror to...

Unsure if this is helpful at all, this is the full list from 'Fix Common Problems' plugin

Can you zip and attach the syslog from your appdata share?

Unlikely to be the cause of your problem, but as FCP says

Your system share has files on the array. Ideally, docker/VM related shares - appdata, domains, system - would have all files on cache or other pool with nothing on the array, so Docker/VM will perform better, and so array disks can spin down since these files are always open. Arguably, system is the most important of these to not have files on the array, since these files really are open anytime Docker or VM Manager is enabled, regardless of whether any dockers/VMs are actually running.

Nothing can move open files. You have to disable Docker and VM Manager in Settings before files in system share can be moved. Set system to

Primary:cache; Secondary:array; Mover action:array->cache.

And as FCP says

Your data share is configured to not use cache, but all its files are actually on cache. They won't be moved because the share has no Mover action. Set to

Primary:cache; Secondary:array; Mover action:cache->array.

You can run Mover by clicking the MOVE button in Array Operation.

8 minutes ago, trurl said:

Can you zip and attach the syslog from your appdata share?

Here you go! :-) Thanks for taking the time, i appreciate your help!

path of this:
cache / appdata / syslog-192.168.1.40.log

syslog-192.168.1.40.log

7 minutes ago, trurl said:

Unlikely to be the cause of your problem, but as FCP says

Your system share has files on the array. Ideally, docker/VM related shares - appdata, domains, system - would have all files on cache or other pool with nothing on the array, so Docker/VM will performa better, and so array disks can spin down since these files are always open. Arguably, system is the most important of these to not have files on the array, since these files really are open anytime Docker or VM Manager is enabled, regardless of whether any dockers/VMs are actually running.

Nothing can move open files. You have to disable Docker and VM Manager in Settings before files in system share can be moved. Set system to

Primary:cache; Secondary:array; Mover action:array->cache.

And as FCP says

Your data share is configured to not use cache, but all its files are actually on cache. They won't be moved because the share has no Mover action. Set to

Primary:cache; Secondary:array; Mover action:cache->array.

You can run Mover by clicking the MOVE button in Array Operations.

Thanks, I will try and fix this :-) This is what it's currently looking like, I will follow your advise here and rescan FCP

1 hour ago, CasperOe88 said:

Do you suspect it is a RAM issue?

Should test just to eliminate that possibility. RAM can be insidious since it can corrupt your data, the OS, anything, without being obvious. And if the OS gets corrupted, it could crash of course.

I always say

You must never attempt to run any computer unless RAM is working perfectly. Everything goes through RAM. The OS and other executable code, your DATA. EVERYTHING!. The CPU can't do anything with anything until it is loaded into RAM.

Just now, trurl said:

Should test just to eliminate that possibility. RAM can be insidious since it can corrupt your data, the OS, anything, without being obvious. And if the OS gets corrupted, it could crash of course.

I always say

You must never attempt to run any computer unless RAM is working perfectly. Everything goes through RAM. The OS and other executable code, your DATA. EVERYTHING!. The CPU can't do anything with anything until it is loaded into RAM.

I will try the hard act of guiding my Wife to initiate the test - from my current location mid-Atlantic

24 minutes ago, trurl said:

Nothing can move open files. You have to disable Docker and VM Manager in Settings before files in system share can be moved. Set system to

Primary:cache; Secondary:array; Mover action:array->cache.

And as FCP says

Your data share is configured to not use cache, but all its files are actually on cache. They won't be moved because the share has no Mover action. Set to

Primary:cache; Secondary:array; Mover action:cache->array.

You can run Mover by clicking the MOVE button in Array Operation.

Just so I don't fuck this up - do I need to change anything to any Docker containers, or will it sort itself out as long as I disable Docker while doing this? :-)

Edited February 7Feb 7 by CasperOe88

Should be OK. If something goes wrong it's very easy to restore as long as you have appdata and the templates on flash.

7 minutes ago, trurl said:

Should be OK. If something goes wrong it's very easy to restore as long as you have appdata and the templates on flash.

Perfect, thanks!!
Now, I've been an idiot and stopped all my Docker containers - Incl. the CloudFlare tunnel that gives me access :-D

I will revert tomorrow once I have guided the missus through how to start it again ;-)

Cheers, have a good day/evening whereever you are..

Altight, the setup of Mover as per above will have to wait until I am on a different network than my current one. I am currently away from home onboard a ship that does not allow for Tailscale connection.

I can only connect through a Cloudflare tunnel that requires Docker to run :-)

Okay, there has been a development! This is how my screen looks like when it crashes:

Did you ever do memtest?

That's log spam and most likely unrelated to the crashing. Try booting in safe mode and see if those still show, and if it still crashes.

Okay, I have been doing a bit of digging - and here is my latest log file. I am looking at two possible causes for the crash being:

1. The boot drive (flash) (sda) due to connection error, bad port- or bad flash drive.
   "Mar 3 10:36:01 CF1000 kernel: sda: detected capacity change from 122880000 to 0"
   

2. My parity drive (sdb) due to read errors, possibly bad sectors on the drive.

Could be both as well - what is your opinions on this?

I have a new flash drive on the way, taken a backup and will try and restore and boot from that one- see if it changes anything.

My NAS has a build in (inaccessible!) NVMe from the maker that I don't currently use for anything. I would love to boot Unraid from that rather than USB but I would have to find a way to clone this with my USB; work in progress!

Cheers!!

syslog-192.168.1.40.txt

Edited March 4Mar 4 by CasperOe88

You can try using a different USB port, if the issues persist, replace the flash drive

As for the parity read errors, they are logged as a disk problem; run an extended SMART test on that disk.

25 minutes ago, JorgeB said:

You can try using a different USB port, if the issues persist, replace the flash drive

I have tried 2 x USB 2.0 ports on my NAS, and the issue appear to be the same. The connectors are not great and they are quite 'tight' so it might be the ports as well ; simple connection interface maybe.

Will try a different USB and see if any better.

26 minutes ago, JorgeB said:

As for the parity read errors, they are logged as a disk problem; run an extended SMART test on that disk.

As for this, every time I try to run the extended SMART test, it fails - so i'm afraid I'll have to splash out on a new drive. I am using EXOS 24TB drives, so won't be cheap sadly - but that's what it is..

19 hours ago, CasperOe88 said:

As for this, every time I try to run the extended SMART test, it fails - so i'm afraid I'll have to splash out on a new drive. I am using EXOS 24TB drives, so won't be cheap sadly - but that's what it is..

Extended SMART test have now been completed for the drive in question, not great news I'm afraid.

What is the experts opinion on this matter? The freeze issue, caused by the lost connection to the flash - or the read errors on the parity?

No the most sophisticated USB on the market, could it be poor quality?

ST24000NM000C-3WD103_ZXA0JE5L-20260305-0402.txt

Edited March 5Mar 5 by CasperOe88

It's unlikely that the freeze would be caused by the bad drive, but the drive needs to be replaced anyway, and if you have already tried multiple USB ports, also replace the flash drive, since that can make the server freeze.