TrueNAS Scale alert for database error

TrueNAS General
1

Hello everyone! I’m running the latest version of TrueNAS Scale 25.04.1, and this week, after a power outage that drained our UPS, the TrueNAS was forced to shut down.

After logging in, I’m receiving the following alerts via email and in the web interface notifications:

Failed to check for alert NTLMv1Authentication: (sqlite3.DatabaseError) database disk image is malformed [SQL: SELECT "audit_SMB_0_1".audit_id, "audit_SMB_0_1".message_timestamp, "audit_SMB_0_1".timestamp, "audit_SMB_0_1".address, "audit_SMB_0_1".username, "audit_SMB_0_1".session, "audit_SMB_0_1".service, "audit_SMB_0_1".service_data, "audit_SMB_0_1".event, "audit_SMB_0_1".event_data, "audit_SMB_0_1".success FROM "audit_SMB_0_1" WHERE "audit_SMB_0_1".event = ? AND "audit_SMB_0_1".message_timestamp > ?] [parameters: ('AUTHENTICATION', 1752721219.673151)] (Background on this error at: https://sqlalche.me/e/14/4xp6)

Does anyone know what the issue could be or where I can find this SQLite3 database, so I can delete it and recreate the system from scratch to resolve the issue?

2

Hmm… it looks like your SMB audit database is maybe corrupted. You can simply delete it. It’s in /audit.

3

Thanks for the feedback. I moved all SMB-related files to -old and restarted the Samba service! Let’s see if we have any error logs tomorrow.

As soon as I have feedback on whether it’s resolved or not, I’ll report back here.

4

Thank you so much! With your suggestion, I was able to solve the problem.
To solve it, I actually had to:
1 - Move all SQLite3 files that started with SMB to -old.
2 - Stop and restart the Samba service (I thought this would recreate the database files, but it didn’t).
3 - To actually recreate them, I went to the audit configuration screen, changed the number of days in the log from 30 to 29, and saved. When I did this, the files were successfully recreated.
Thank you very much!