Change in percent disk used after directory deletion and recovery

[Jeff Boyce]

----- Original Message ----- 
From: "Ed Wilts" <ewilts at ewilts.org>
To: "Jeff Boyce" <jboyce at meridianenv.com>; "General Red Hat Linux discussion 
list" <redhat-list at redhat.com>
Sent: Tuesday, February 28, 2006 10:22 AM
Subject: Re: Change in percent disk used after directory deletion and 
recovery


> On Tue, Feb 28, 2006 at 09:41:51AM -0800, Jeff Boyce wrote:
>> I am hoping someone may be able to educate me on how to diagnose what
>> happened to my system.  I have a Dell PE2600, running RHES 3 completely
>> up2date, PERC 4/di, Raid5 with 3x36G drives, functioning primarily as a
>> Samba file server to 8 window desktops.  I was notified yesterday morning
>> that it appeared that a directory under our primary Samba share was
>> missing. This directory contained our active projects files, approx. 11G
>> and 16,500 files.  It was there one moment, then gone about a half hour
>> later; I am presuming an accidental deletion at this point.  I looked
>> through some of the log files (samba logs, and others I don't recall) and
>> found no indication of what might have happened.  So I restored the
>> directory and all its files from tape to a new directory with success. 
>> The
>> logwatch summary of disk space for before the deletion event and after 
>> the
>> restoration of the directory are shown below.  The deleted directory was
>> under the /ecosystem share mount.  The current disk usage puzzles me
>> because it appears that the increase in disk space used on /sda10 is 
>> equal
>> to the size of the directory restored from tape.
>>
>> Questions:
>> 1.  Is it possible that the directory was not deleted, but instead hidden
>> in some way?
>
> I've seen this happen on one of my file servers (happens to be VMS but
> that doens't matter).  Users go ahead and rename directories by accident
> all the time.  It's way too easy to fat-finger this in a Windows GUI.
>
>> 2.  Where would I look to find evidence of what might have happened to 
>> the
>> directory initially?
>
> I'd update the slocate database and then do a couple of searches for
> files that you know are there and see if they pop up in multiple spots.
>
>> 3.  Why is my disk usage significantly increased following restoration of
>> the directory?
>
> Because the original files were never deleted.
>
>> 4.  How should I assign permissions to a primary directory to prevent
>> accidental deletion, yet still allow subdirectories under this directory 
>> to
>> be created, deleted, and otherwise be used by all employees?
>
> I don't think you can.  On Linux, write implies delete.  Not so on other
> OSs.
>
>
> Aren't you glad you had good backups?
>
>        .../Ed
>
> -- 
> Ed Wilts, RHCE
> Mounds View, MN, USA
> mailto:ewilts at ewilts.org
> Member #1, Red Hat Community Ambassador Program
>

Ed -

Thanks for the insight and the lesson to use locate.  As Paul Harvey would 
say; now I know the rest of the story.  A simple locate on a single file 
found that the missing directory had been accidentally moved to an adjacent 
subdirectory as a result of a bad mouse move in a Windows GUI.  I wish I 
would have thought of that yesterday while others were in a panic.  I was 
calm because I knew that it was only an inconvenience to restore from tape 
and not a catastrophe.  The results of the locate fits the description 
provided to me from the person explaining what they thought they did.  And 
it explains the significant increase in disk usage.  I am very glad that we 
have a good tape backup system.  Overall we only lost a hour and a half of 
time and had to re-edit a couple of files.

[jeffb at Bison jeffb]$ locate StanESA.doc
/ecosystem/Projects/LEAPS/StanESA.doc
/ecosystem/Reference/Projects/LEAPS/StanESA.doc

Jeff Boyce
Meridian Environmental
www.meridianenv.com