Odd file in /lost+found after softupdate inconsistency in fsck

[Andriy Gapon]

on 05/03/2008 14:43 Tod McQuillin said the following:
> Hi all,
> 
> My server froze up tonight after a 2 month uptime running 6.3-PRERELEASE 
> from Dec 28 2007.
> 
> I had to fsck /home by hand because of an inconsistency fsck couldn't 
> repair automatically -- something to do with an unexpected softupdate 
> inconsistency.
> 
> After that, I ended up with some files in /home/lost+found, one of which 
> is quite interesting:
> 
> /home/lost+found# ls -lksh
> total 24432
> 24432 -r--------  1 root  operator    40G Mar  5 20:12 #0000005
> 
> It is 40G in size but only occupies 24432k on disk, so it is a sparse 
> file.  I'm not aware of any sparse files of quite that size on my system 
> (or relative sparseness) but it's possible i might overlook one.
> 
> But the thing that's interesting to me is the inode number (inode 5) and 
> the fact that rm doesn't want me to remove it:
> 
> /home/lost+found# rm \#0000005
> override r--------  root/operator snapshot for #0000005? n

Are you sure that it doesn't want to remove it? It's just asking you the
question (maybe because you executed rm  as non-root or maybe because of
the mode of the file); you can answer 'yes', you know.

> Is there a magic "shapshot" flag on the file?  Have I somehow damaged my 
> ufs2+softupdates filesystem by losing its inode #5 containing snapshot 
> data?
> 
> Any insights appreciated,

You can try stat(1) on it to see all the details, that could help with
further conclusions.

-- 
Andriy Gapon