System: TrueNAS CE 25.10.1 - Goldeye
Primary Pool: 8 x 16TB HDDs
Data VDEVs: 2 x RAIDZ1 | 4 wide | 14.55 TiB (No other VDEV types)
My main dataset is used as a media server. The vast majority of files on it have hardlinks. It is Unencrypted. I have daily snapshots in place.
Sync: STANDARD
Compression: Inherit (1.00x (LZ4))
Enable Atime: OFF
ZFS Deduplication: OFF
Case Sensitivity: OFF
Path: apool/data
The dataset has an SMB share that is used for me to access from a Windows machine. No automated tools access the SMB share. I’m the only user.
The dataset has an NFS share that is used by many containerised tools (qbittorrent, radarr, cross-seed, plex server, etc) on unprivileged LXCs on a ProxmoxVE machine.
The question:
I have a rare, but recurring problem. A file went missing, like it was deleted. It was hardlinked, so the file data wasn’t actually lost, just the file missing from its folder. All of its hardlinked copies were accounted for, so the file wasn’t just moved to another folder. I can see the 24hr window it went missing between daily snapshots.
This was easy to rectify, but I would like to track down the cause.
Data scrubs and smart checks are clean. That file had 9 other hardlinked copies, many of which were created at the same time and are controlled by the same automation tools, but none of them were affected. There’s nothing about this file that makes it stand out from my other media files except that it disappeared.
Can I examine a “missing” file to see when it was last acted on, what happened, and which userid was responsible? How can I do that? I see that there’s an Audit tool in Settings but it looks like it’s for SMB, and doesn’t reveal what file operations are made, or which files are acted on. That’s probably me missing something obvious though.
Even just the exact timestamp of file removal would be helpful.
Is there a tool or setting that I should use to better examine this issue the next time it happens?