ZFS - directory entry

[Dirk-Willem van Gulik]

> On 14 Dec 2016, at 19:51, Peter Jeremy <peter at rulingia.com> wrote:
> 
> On 2016-Dec-14 16:27:00 +0100, Dirk-Willem van Gulik <dirkx at webweaving.org> wrote:
>> A rather odd directory entry (in /root, the home dir of root/toor) appeared on a bog standard FreeBSD 10.2 (p18) lightly loaded machine under ZFS during/post a backup:
>> 
>> $ ls -la /root | tail -q
>> ----------   1 root  wheel  9223372036854775807 Jan  1  1970 ?%+?kD?H???x,?5?Dh;*s!?h???jw??????\h?:????????``?13?@?????OA????????Puux????<T]???R??Qv?g???]??%?R?
>> 
>> OS and ZFS is installed with a bog standard sysinstall. ‘SMART’ nor smartd have reported anything. nothing in dmesg, syslog of boot log. Any suggestions as how to debug or get to the root of this ? 
>> 
>> And in particular - what is a risk of a reboot (to get a kernel with debug, etc) causing the issue to ‘go away’ - and hence stopping the forensic ?
> 
> Do you have ECC RAM?  If not, it's possible this is an artifact of some RAM
> corruption, rather than on-disk corruption.

No ECC (simple 4x8 Gbyte sticks; nothing on L2 and L3 either).

> I'm surprised by the slow scrub, though they are very slow disks.  You might
> like to use gstat or zpool iostat to see if one of the disks is slower than
> the others - indicating a possible problem with it.

Perfectly balanced. Rocks steady last few hours according to per disk graphs. We’ll see how it goes before rebooting (and if it is indeed memory - that will I guess mask the issue until it appears again).

Thanks,

Dw