I expect this is user error, but I thought I'd post in case anyone else is
feeling a similar sense of losing their mind.
I have a root cron job:
0 3 * * * rsync -Hva --stats --del ... / /media/2tb/bak/dancer-`date +\%F`/
"..." represents 4 --link-dest's and 22 --exclude's (including
/media/).
So last night, / should have been copied to
/media/2tb/bak/dancer-2010-11-29/.
Instead, when I checked on my backups this morning, instead of
/media/2tb/bak/dancer-2010-11-29/, / had been copied to /media/2tb/.
The differences corresponded exactly to the --excludes. There was no
/media/2tb/dev/, and /media/2tb/tmp/ contained what it had the previous
day, not the same as /tmp/.
And of course, due to the --del, it deleted everything else I had in
/media/2tb/. I have since removed the --del, since it was there for
reasons no longer relevant.
/media/2tb is, as you might imagine, a mount point for a 2tb hard drive.
The only way I can imagine this happening is if
/media/2tb/bak/dancer-2010-11-29/ were a simlink to /media/2tb/. Which is
madness.
Or I guess I could have run it from the command line, but:
darxus at dancer:~$ history | grep rsync
3471 man rsync
4997 history | grep rsync | less
4999 history | grep "sudo.*rsync"
5004 history | grep rsync
darxus at dancer:~$
root's history contains rsync commands with the targets:
/media/2tb/bak/dancer-`date +%F`/
dancer-2010-11-01b
dancer-2010-11-01b
/media/2tb/bak/dancer-`date +%F`/
I did verify the copy of / in /media/2tb/ contained an update to a file I
made just last night.
Since I used the -a flag to rsync, I don't think it's possible to verify
the copy happened around the time of the cron job.
Any other ideas? Other than I or someone else, unknown to me, maliciously
kicked off this rsync, and then removed the evidence?
--
"I don't want people who want to dance, I want people who have to
dance."
--George Balanchine
http://www.ChaosReigns.com