January 2, 20179 yr Help!!! I was using a VM and spotted that around 5.5TB of files 'disappeared' with my used space dropping from 96% to 72%. I'm hoping the files are still there as Plex and Sonarr say the files are there, yet when I try to play in Plex they aren't found. The files aren't 'there' in SMB either Two main directories seemed to have been affected media/TV Shows and media/Kids TV Shows, with the latter disappearing completely from file manager. I'm not sure if other directories have been affected. Sonarr has updated to show that some of the media/TV Shows have gone but it again like Plex thinks all the Kids TV Shows are still there. I even tried with a couple of the kids shows to delete them in sonarr and then re-add, but it got even weirder then. After I recreated the Kids TV Shows folder manually, it wouldn't create a season folder for the new show. I even tried creating media/TV Shows Kids and media/TV Shows - Kids to try and trick it into creating new folders, but that didn't work. It will however create new show folders in the media/TV Shows folder that wasn't totally nuked.... Any ideas? All help appreciated, particularly as my kids will wake up tomorrow and find out all their shows have gone. highlander-diagnostics-20170102-2038.zip
January 2, 20179 yr One thing is that a bunch of your shares are all set to be read-only from the ransomware plugin. Which *implies* that the files themselves have been outright deleted from a program running on your server (plex, etc) or that an actual attack took place.
January 2, 20179 yr Community Expert It also looks like you have a "Media" share and a "media" share, although FCP doesn't seem to log that so I'm not sure. If that is indeed the case, then SMB will only show one of these since it is not case sensitive but linux is, and you are probably seeing the wrong one.
January 2, 20179 yr Author One thing is that a bunch of your shares are all set to be read-only from the ransomware plugin. Which *implies* that the files themselves have been outright deleted from a program running on your server (plex, etc) or that an actual attack took place. which shares (other than the ransomware generated ones) are set to read-only? I can't see any. I think what's happened is Plex went mad with a library update and nuked my TV shows somehow :-(
January 2, 20179 yr Author It also looks like you have a "Media" share and and "media" share, although FCP doesn't seem to log that so I'm not sure. If that is indeed the case, then SMB will only show one of these since it is not case sensitive but linux is, and you are probably seeing the wrong one. where do you see media and Media?
January 2, 20179 yr One thing is that a bunch of your shares are all set to be read-only from the ransomware plugin. Which *implies* that the files themselves have been outright deleted from a program running on your server (plex, etc) or that an actual attack took place. which shares (other than the ransomware generated ones) are set to read-only? I can't see any. I think what's happened is Plex went mad with a library update and nuked my TV shows somehow :-( appdata? and most of the "z" ones. But it could be left over's from a previous false trip. It also looks like you have a "Media" share and and "media" share, although FCP doesn't seem to log that so I'm not sure. If that is indeed the case, then SMB will only show one of these since it is not case sensitive but linux is, and you are probably seeing the wrong one. where do you see media and Media? M---a.cfg and m---a.cfg But we can't tell on an anonymized diagnostics what those files actually are, and it doesn't appear in the syslog that FCP found any errors. But it wouldn't hurt to go into FCP and run a scan and see what it says As far as Plex going haywire, anything's possible, but I would think its more likely that media was inadvertently deleted by a user (either through Plex or via the network). One reason why I'm a huge fan of only giving apps like Plex (which have the ability to delete media) read-only access to all the volume mounts with the exception of the /config mapping Either way, the syslog is clean for problems that can potentially indicate that unRaid has lost track of data, so inadvertent deletions are the primary suspect.
January 2, 20179 yr Community Expert Your diagnostics indicates you have over 100 user shares, and the names of some of these appear to be the same except for upper / lower case. Possibly the diagnostics aren't working correctly. Or possibly you have misconfigured some things. Or as Squid says, maybe you had these at one time but they aren't there anymore. I think maybe the .cfg files in the config/shares folder don't get cleaned up when remove a share. Post a screenshot of your Shares - User Shares page.
January 2, 20179 yr Author One thing is that a bunch of your shares are all set to be read-only from the ransomware plugin. Which *implies* that the files themselves have been outright deleted from a program running on your server (plex, etc) or that an actual attack took place. which shares (other than the ransomware generated ones) are set to read-only? I can't see any. I think what's happened is Plex went mad with a library update and nuked my TV shows somehow :-( appdata? and most of the "z" ones. But it could be left over's from a previous false trip. It also looks like you have a "Media" share and and "media" share, although FCP doesn't seem to log that so I'm not sure. If that is indeed the case, then SMB will only show one of these since it is not case sensitive but linux is, and you are probably seeing the wrong one. where do you see media and Media? M---a.cfg and m---a.cfg But we can't tell on an anonymized diagnostics what those files actually are, and it doesn't appear in the syslog that FCP found any errors. But it wouldn't hurt to go into FCP and run a scan and see what it says As far as Plex going haywire, anything's possible, but I would think its more likely that media was inadvertently deleted by a user (either through Plex or via the network). One reason why I'm a huge fan of only giving apps like Plex (which have the ability to delete media) read-only access to all the volume mounts with the exception of the /config mapping Either way, the syslog is clean for problems that can potentially indicate that unRaid has lost track of data, so inadvertent deletions are the primary suspect. my appdata is on an unassigned drive - how do I change back to read/write? if it's read only that could explain Sonarr acting weird as well. I think the culprit was plex - I was syncing my tablet for the first time in a while and I think it got confused when it tried to update, but I'm flabbergasted that a 5GB sync would nuke 5.5TB of content.
January 2, 20179 yr Community Expert Don't know what happened but I think it is extremely unlikely that plex deleted your files.
January 2, 20179 yr Author Your diagnostics indicates you have over 100 user shares, and the names of some of these appear to be the same except for upper / lower case. Possibly the diagnostics aren't working correctly. Or possibly you have misconfigured some things. Or as Squid says, maybe you had these at one time but they aren't there anymore. I think maybe the .cfg files in the config/shares folder don't get cleaned up when remove a share. Post a screenshot of your Shares - User Shares page. I think it's the ransonware shares confusing the logs http://screenshot.co/#!/122b51341b I had Media when I first started with unraid and changed to media once I realised linux was case sensentive
January 2, 20179 yr If appdata is shared on a ud device then there is nothing to change Sent from my LG-D852 using Tapatalk
January 2, 20179 yr Community Expert That screenshot doesn't show us everything, but I have to wonder why you have so many User shares. Are you aware that any folder at the top level of cache or any array drive is automatically a User share?
January 2, 20179 yr Author Don't know what happened but I think it is extremely unlikely that plex deleted your files. Agree as my media/import folder was also deleted (more pain as a lot of unprocessed files in there) and Plex doesn't have access to that folder as Sonarr is the only app that would be looking at both media/import/TV Shows and moving to media/TV Shows. PLex only looked media/TV Shows. Would explain why Sonarr can't add new folders properly as it's obviously gone bonkers - going to remove and install a fresh copy.
January 2, 20179 yr Author That screenshot doesn't show us everything, but I have to wonder why you have so many User shares. Are you aware that any folder at the top level of cache or any array drive is automatically a User share? I was trying to show that most of the shares are ransomware ones. I didn't post a full screenshot as some of the shares have usernames on and 'DZMM' isn't my real name, and I couldn't be bothered to hide them! On my user share page I have 40 bait ransomware shares, 16 genuine shares and then 7 directories on an UD (acd, appdata, comm apps backupx2, domains, plex and system).
January 4, 20179 yr Author WTF!!!!! Just connected to server to find my whole media share has gone now along with my whole plex library - over 22TB of files. Disaster!!!! I havent rebooted this time so hopefully the diags will show something. I can PM the whole logs if that helps. Im tempted to rebuild the whole server from scratch as there's barely anything left on it......i have some files backed up to acd,which might help highlander-diagnostics-20170104-0051.zip
January 4, 20179 yr Community Expert Mostly just "cache drive full". Maybe you have some app misconfigured to move stuff to cache and so it tries to copy files to cache and then deletes them even though the copy fails due to the drive being full.
January 4, 20179 yr Author Mostly just "cache drive full". Maybe you have some app misconfigured to move stuff to cache and so it tries to copy files to cache and then deletes them even though the copy fails due to the drive being full. Maybe, but that wouldn't delete the existing folders as well? I think there's a similar problem where one of my dockers sonarr, lazy librarian, headphones or sabnzbd when trying to cleanup folders in media after moving files is inadvertently deleting the whole folder. Or, because my array was so full my custom mover script was falling over abd failing
January 4, 20179 yr Author What I'm going to is make a new share structure and split media into new seperate books, music, movies, TV shows and photos shares, so that I can segment how much access each docker has in case I get a rogue one in the future.
January 4, 20179 yr I would also suggest some kind of backup strategy as well, so you don't find yourself in a situation like this again where you've lost data.
January 4, 20179 yr Community Expert Or, because my array was so full my custom mover script was falling over abd failing Why do you have a custom mover script?
January 4, 20179 yr Author Or, because my array was so full my custom mover script was falling over abd failing Why do you have a custom mover script? http://lime-technology.com/forum/index.php?topic=50416.msg487850#msg487850 Allowed me to make more use of my cache by having files only moved when the cache got full, rather than IMO sometimes wastefully every night.
January 4, 20179 yr Author I would also suggest some kind of backup strategy as well, so you don't find yourself in a situation like this again where you've lost data. I do have a strategy using a1acd, but it hadn't finished uploading - unfortunately the files that are backed up so far are the ones I havent lost!! I am considering a local option now.
January 4, 20179 yr Or, because my array was so full my custom mover script was falling over abd failing Why do you have a custom mover script? http://lime-technology.com/forum/index.php?topic=50416.msg487850#msg487850 Allowed me to make more use of my cache by having files only moved when the cache got full, rather than IMO sometimes wastefully every night. Not custom mover script. Just a custom script that calls the stock mover under certain conditions
Archived
This topic is now archived and is closed to further replies.