Huge data drop in seconds...!

[mattiasvdm]

Help needed,

I work at a company with several Mac servers, Mac workstations and San storages. This morning from one moment to another about 200GB of data disappeared from the storage.

In our monitoring software we can see the data drop down within approximately 2 minutes!?!

What I wonder is how is this possible? If someone deleted or replaced it, it should take a lot longer than 2 minutes. So how is it technically possible to delete 200GB of data within 2 minutes???

The data was on a san storage which was mounted on a Xserve. The total size of this mounted disk is about 2.5TB.

Thanks...

 

[matspekkie]

Help needed,

I work at a company with several Mac servers, Mac workstations and San storages. This morning from one moment to another about 200GB of data disappeared from the storage.

In our monitoring software we can see the data drop down within approximately 2 minutes!?!

What I wonder is how is this possible? If someone deleted or replaced it, it should take a lot longer than 2 minutes. So how is it technically possible to delete 200GB of data within 2 minutes???

The data was on a san storage which was mounted on a Xserve. The total size of this mounted disk is about 2.5TB.

Thanks...

I am not very familiar with san storage but i had deleted bigger sparseimages in less time by a simple overwrite. So my question is what kind of data was it since large files delete a lot quicker then thousands of small files.
Another thing could be that the 200 GB was allready long gone before an reindex has initiated and fixed the real data usage for that volume.

 

[mattiasvdm]

I am not very familiar with san storage but i had deleted bigger sparseimages in less time by a simple overwrite. So my question is what kind of data was it since large files delete a lot quicker then thousands of small files.
Another thing could be that the 200 GB was allready long gone before an reindex has initiated and fixed the real data usage for that volume.

The missing data consist several hundred movie trailers. So no easy delete. At 9:14 am the data was still there and at 9:16 it was gone...

 

[mrichmon]

What I wonder is how is this possible? If someone deleted or replaced it, it should take a lot longer than 2 minutes. So how is it technically possible to delete 200GB of data within 2 minutes???

The data was on a san storage which was mounted on a Xserve. The total size of this mounted disk is about 2.5TB.

Thanks...

Deleting a file that is stored on a modern filesystem does not involve overwriting the file. Rather, the inode associated with the file is cleared. Clearing the inode is performed in roughly constant time and has little relationship to the size of the file.

I don't have a SAN available right now, but on the hard drive in my 2009 Mac Mini it takes 0.056s to delete a 1GB file. If you have 200 1GB files then it would take roughly 11.2s to delete 200GB.

Even allowing a 200% increase in delete processing time on your SAN you can see that it is trivial for this amount of data to be deleted in the time mentioned. If the missing files were all stored in a small number of folders then the most likely scenario is that a user deleted the folders.