UFS Crash and directories now missing

[Alejandro Imass]

On Fri, Apr 27, 2012 at 7:52 PM, Alejandro Imass <aimass at yabarana.com> wrote:
> Hi folks,
>
> We had a server crash and required a hard reboot. The system is on one
> disk and another disc mounts /usr/jails and everything runs in jails,
> pristine base system, and the base system is working perfectly.
>
> The second volume, the one with the jails mounted but every jail
> directory disappeared except one. df still shows the data being used
> so I'm guessing it's a logical error in the directory structure or
> something. I unmounted the drive and ran fsck and reported no
> problems. df shows the data being use so where is the data??
>

OK, so here is an update, maybe someone has some clue here....

All the jails wound up in the /usr/local/etc/apache22 of the only
surviving jail which is the http proxy to all the other jails.

Right before the server crashed I noticed MySQL at 100% o several CPUs
and the server was on it's knees, so I'm wondering.... was this an
attack? is it possible that Apache or MySQL moved the files??

I mean the jails are there, I'm even backing them up right now.... but
how did these directories move here?????

Anybody has ANY logical explanation???

Thanks,

-- 
Alejandro Imass

> This is FreeBSD 8.2 updated, patched etc. The volume was UFS + Journal
>
> Any help is GREATLY appreciated!
>
> Thanks!
>
> --
> Alejandro Imass