ZFS - directory entry

[Alan Somers]

On Wed, Dec 14, 2016 at 12:01 PM, Dirk-Willem van Gulik
<dirkx at webweaving.org> wrote:
>
>> On 14 Dec 2016, at 19:51, Peter Jeremy <peter at rulingia.com> wrote:
>>
>> On 2016-Dec-14 16:27:00 +0100, Dirk-Willem van Gulik <dirkx at webweaving.org> wrote:
>>> A rather odd directory entry (in /root, the home dir of root/toor) appeared on a bog standard FreeBSD 10.2 (p18) lightly loaded machine under ZFS during/post a backup:
>>>
>>> $ ls -la /root | tail -q
>>> ----------   1 root  wheel  9223372036854775807 Jan  1  1970 ?%+?kD?H???x,?5?Dh;*s!?h???jw??????\h?:????????``?13?@?????OA????????Puux????<T]???R??Qv?g???]??%?R?
>>>
>>> OS and ZFS is installed with a bog standard sysinstall. ‘SMART’ nor smartd have reported anything. nothing in dmesg, syslog of boot log. Any suggestions as how to debug or get to the root of this ?
>>>
>>> And in particular - what is a risk of a reboot (to get a kernel with debug, etc) causing the issue to ‘go away’ - and hence stopping the forensic ?
>>
>> Do you have ECC RAM?  If not, it's possible this is an artifact of some RAM
>> corruption, rather than on-disk corruption.
>
> No ECC (simple 4x8 Gbyte sticks; nothing on L2 and L3 either).
>
>> I'm surprised by the slow scrub, though they are very slow disks.  You might
>> like to use gstat or zpool iostat to see if one of the disks is slower than
>> the others - indicating a possible problem with it.
>
> Perfectly balanced. Rocks steady last few hours according to per disk graphs. We’ll see how it goes before rebooting (and if it is indeed memory - that will I guess mask the issue until it appears again).
>
> Thanks,
>
> Dw

If your system is mostly idle, then you can speedup scrub with the
following sysctls:
vfs.zfs.resilver_min_time_ms=5000
vfs.zfs.top_maxinflight=1024 # 1024 is appropriate for 8GB of ram.
With more RAM, you can go higher.

-Alan