UFS Crash and directories now missing

[Alejandro Imass]

On Sat, Apr 28, 2012 at 1:43 AM, Wojciech Puchar
<wojtek at wojtek.tensor.gdynia.pl> wrote:
>>
>> All the jails wound up in the /usr/local/etc/apache22 of the only
>> surviving jail which is the http proxy to all the other jails.
>>
>> Right before the server crashed I noticed MySQL at 100% o several CPUs
>> and the server was on it's knees, so I'm wondering.... was this an
>> attack? is it possible that Apache or MySQL moved the files??
>>
>> I mean the jails are there, I'm even backing them up right now.... but
>> how did these directories move here?????
>>
>> Anybody has ANY logical explanation???
>>
> 99% - someone did moved them.
> 1% - hardware problem possibly memory. without this there is no way for
> directory to be "accidentally" moved

I somewhat agree, but it wasn't a person. I am the only administrator,
the only one with root access. The jails were effectively moved to the
/usr/local/etc/apache22 of the single that survived at the top level.
I'm thinking something between mount, EzJail, the journal and the way
MySQL created a great deal of head contention, so something must have
gotten corrupted at the directory level like you state, but the
strange part is no _data_ corruption as such, because I was able to
physically archive the jails, move them to the correct directory and
archived them all with ezjail-admin to a different disk. I was
thinking of formatting the jails drive, but after all this disk
activity and no errors, and everything booted up correctly, I am not
so sure now that it's needed it.