Change in percent disk used after directory deletion and recovery

[Ed Wilts]

On Tue, Feb 28, 2006 at 09:41:51AM -0800, Jeff Boyce wrote:
> I am hoping someone may be able to educate me on how to diagnose what 
> happened to my system.  I have a Dell PE2600, running RHES 3 completely 
> up2date, PERC 4/di, Raid5 with 3x36G drives, functioning primarily as a 
> Samba file server to 8 window desktops.  I was notified yesterday morning 
> that it appeared that a directory under our primary Samba share was 
> missing. This directory contained our active projects files, approx. 11G 
> and 16,500 files.  It was there one moment, then gone about a half hour 
> later; I am presuming an accidental deletion at this point.  I looked 
> through some of the log files (samba logs, and others I don't recall) and 
> found no indication of what might have happened.  So I restored the 
> directory and all its files from tape to a new directory with success.  The 
> logwatch summary of disk space for before the deletion event and after the 
> restoration of the directory are shown below.  The deleted directory was 
> under the /ecosystem share mount.  The current disk usage puzzles me 
> because it appears that the increase in disk space used on /sda10 is equal 
> to the size of the directory restored from tape.
> 
> Questions:
> 1.  Is it possible that the directory was not deleted, but instead hidden 
> in some way?

I've seen this happen on one of my file servers (happens to be VMS but
that doens't matter).  Users go ahead and rename directories by accident
all the time.  It's way too easy to fat-finger this in a Windows GUI.

> 2.  Where would I look to find evidence of what might have happened to the 
> directory initially?

I'd update the slocate database and then do a couple of searches for
files that you know are there and see if they pop up in multiple spots.

> 3.  Why is my disk usage significantly increased following restoration of 
> the directory?

Because the original files were never deleted.

> 4.  How should I assign permissions to a primary directory to prevent 
> accidental deletion, yet still allow subdirectories under this directory to 
> be created, deleted, and otherwise be used by all employees?

I don't think you can.  On Linux, write implies delete.  Not so on other
OSs.


Aren't you glad you had good backups?

        .../Ed

-- 
Ed Wilts, RHCE
Mounds View, MN, USA
mailto:ewilts at ewilts.org
Member #1, Red Hat Community Ambassador Program