Re: [rdiff-backup-users] data disappearing

[Andrew K. Bressen]

Susanne Hemker <address@hidden> writes:
> Hi everybody,
> during the rdiff-backups I run every night there seems to be data
> disappearing. I don't think anybody has hacked into our system and is
> deleting the files. From last night I got the following output for a lot
> of files:
>
> UpdateError
> src/oscar-2.0/packages/mpich/RPMS/mpich-oscar-module-1.2.4-7.i586.rpm
> File changed from regular
>  file before signature

It is possible to get this error for a file that legitimately no longer exists.
I have a few files on my system that haven't existed for months and
still generate this error. See the wiki entry on the UpdateError and
cleaning up the metadata. 

> When I looked at the rdiff-backup directory and tried to list the
> increments I got:
>
> Fatal Error: Unable to find rdiff-backup-data directory
>
> and 
>
> rdiff-backup --check-destination-dir /backup/rdiff-backups/home_usr 
> Fatal Error: No destination dir found at
> /backup/rdiff-backups/home_usr

That is more of a problem. 
Firstly, are you sure you got the syntax and filenames exactly correct?
Secondly, do you actually have an rdiff-backup metadata directory,
and if so, what does it contain? 

> This means the meta-data file is gone but also when I checked the
> directory src/oscar-2.0/packages/mpich/RPMS/ 
> the mpich-oscar-module-1.2.4-7.i586.rpm was gone (along with a lot of
> stuff, the log file is 68 pages long)

The source rpm file was missing, or the backup file was missing?
Are you sure it wasn't legitimately deleted? IE, it is supposed to be there? 
Have you verified with ls that the metadata file is missing? 

If files are disappearing, I'd say that something is responsible :)
It's possible that it is rdiff-backup, but I sort of doubt it.

If source files, as opposed to backups, are disappearing, then 
I very much doubt rdiff-backup is at fault. 

It need not be Evil Cracker activity; more systems are screwed up
by accident than on purpose. Is the target filesystem ok? Anything 
in lost+found? /tmp?