filesystem screwed after aborted fsck.ext3

evilninja
Thu, 24 Jun 2004 22:57:14 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

hi,

a good friend of mine had some trouble with his fs yesterday. i have
some details now and wonder if you have some thoughts on it, even it may
turn out not to be an ext3 issue at all. sorry, the post is a bit too long:

the ext3 fs was running for several months now on a RAID controller. due
to a user error, the RAID controller decided to rebuild the (RAID-5)
array, but only for one disk. iow: 6 disks were ok, 1 disk was to be
rebuilt, 1 disk is hot-spare anyway. the rebuilt finished and indeed -
the controller was visible again and my pal was able to mount the fs.

although the mount seemed to be successful, there was a warning like
"warning: mounting unlclean filesystem, need fs check" (no, i
don't have
the exact spelling at hand). hm, he somehow must have ignored this and
continued to use the fs anyway. but it turned out, that several daemons
would not start, and "some strange things" lead him to the assumption,
that something must be wrong. so he fired up an fsck.ext3 on the
(unmounted) fs. commiting several questions ("Fix? y|n") with
"yes", my
pal interrupted the check, and started again with "-y", so that fsck
could run during the whole night and even still in the morning, so he
interrupted it again.
  --> and now comes the worst part. after mounting the fs again, *all*
files and directories were GONE! and lost+found is now filled up with
1.5e6 files and directories.

the top-level dirs of lost+found are all named after (inode?)numbers,
then we have directorynames/filenames too. but a lot of the files seem
to be double and appear in several directories again. our task now would
be to sorten out the "important" stuff, rename, find out what filename
"0edakka.da" used to be and so on.

as you can see, this is really a vague explanation of the issue here. i
have no logfiles at hand, i can't send you the output of fsck/debugsfs
runs a.t.m, but i'll be able to do all this later today, if it helps.
all i can add is: this is a i386 SMP (amd 1900+), running
debian/unstable (so we must have e2fsprogs 1.35 i think), kernel is
vanilla 2.4.25 (or is it debian's version...?)

i would be very happy, if someone has some hints on this. why moved
e2fsck everything to lost+found, when the directory-structure was almost
intact before?

thanks in advance,
Christian.
- --
BOFH excuse #369:

Virus transmitted from computer to sysadmins.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFA21xKC/PVm5+NVoYRAsVZAJ99S7/QwZDOl6LOWYa7XQIJ6GNElwCeMHWJ
0qIKWsr1TfLH90BWDdW6bEE=GMNg
-----END PGP SIGNATURE-----