<div dir="auto"><div dir="auto">check out the syslogs of iptables logs on ip address access during that time.</div>maybe you should move in the future to the centralised logging independent of vm infrastructure</div><div class="gmail_extra"><br><div class="gmail_quote">Am 07.08.2017 2:20 nachm. schrieb <<a href="mailto:lemonnierk@ulrar.net">lemonnierk@ulrar.net</a>>:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">> It really depends on the application if locks are used. Most (Linux)<br>
> applications will use advisory locks. This means that locking is only<br>
> effective when all participating applications use and honour the locks.<br>
> If one application uses (advisory) locks, and an other application now,<br>
> well, then all bets are off.<br>
><br>
> It is also possible to delete files that are in active use. The contens<br>
> will still be served by the filesystem, but there is no accessible<br>
> filename anymore. If the VMs using those files are still running, there<br>
> might be a way to create a new filename for the data. If the VMs have<br>
> been stopped, and the file-descriptior has been closed, the data will be<br>
> gone :-/<br>
><br>
<br>
Oh the data was gone long before I stopped the VM, every binary was<br>
doing I/O errors when accessed, only whatever was in ram (ssh ..) when<br>
the disk got suppressed was still working.<br>
<br>
I'm a bit surpised they could be deleted, but I imagine qemu through<br>
libgfapi doesn't really access the file as a whole, maybe just the part<br>
it needs when it needs it. In any case the gluster logs show clearly<br>
file descriptor errors from 8h47 AM UTC, which seems to match our first<br>
monitoring alerts. I assume that's when the deletion happened.<br>
<br>
Now I just need to figure out what they used to access the volume, I<br>
hope it's just NFS since that's the only thing I can think of.<br>
<br>______________________________<wbr>_________________<br>
Gluster-users mailing list<br>
<a href="mailto:Gluster-users@gluster.org">Gluster-users@gluster.org</a><br>
<a href="http://lists.gluster.org/mailman/listinfo/gluster-users" rel="noreferrer" target="_blank">http://lists.gluster.org/<wbr>mailman/listinfo/gluster-users</a><br></blockquote></div></div>