TrueNAS Scale unexpected increase in drive capacity usage

[gswhiteuk]

Hi Everyone,

I am running TrueNAS-SCALE-22.12.3.3

I have a 36TB System consisting of 6 x 8TB drives.

Yesterday I was carrying out some maintenance and installing a new docker image. I checked my storage and had 19.2TB Free.

I arrived home from work this evening and now have 13.58TB free. So overnight I appear to have lost approximately 6 TB without any reason, as I have not copied 6TB of data to the system.

Need help please, is there a log of transfers or recently transferred files to the system? How can I have lost such a significant amount of data storage?

6TB is a hell of a lot of data. Before yesterday I consistently had approx 19TB free.

Any help is gratefully appreciated :)

Gary

 

[Arwen]

If you have snapshots AND have those file systems shared to MS-Windows PCs active all the time, extra storage usage is a sign of encrypting ransomware. ZFS snapshots will hold the files as they existed at the time of the snapshot, likely before the ransomware encrypted your files.

Not saying it's ransomware... just one possibility.

 

[winnielinnie]

You can use the "zfs" command to get an overview of where your space resides:

Code:

zfs list -r -t filesystem -o space <nameofpool>

This can narrow down where to investigate.

Take note of the USEDSNAP column.

 

[gswhiteuk]

Thanks, everyone, managed to track it down! Believe it or not, it was snapshots!

Using the command line I deleted all historical snapshots and got nearly 6TB back.

Not sure why that should happen to be honest. Thanks for both of your advice.

It really helped track down where the storage disappeared too.

 

[gswhiteuk]

what the hell is that post lol

 

[Arwen]

Historical snapshots would not grow unless new data was written. Especially overnight.

My comment about encrypting ransomware still applies. Except you may have deleted your good copies of data.

Again, that said, I don't know it's encrypting ransomware.


As for that strange post, it's SPAM and that is why we have a "Report" button on each post. Which I used.