Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[emme]

Hello,
I have a problem with the 320L.

One month ago I have changed the hdds in the NAS upgrading from 2x2TB to 2x6TB (WD60EFRX).
After changing the hdds I have updated the firmware and resetted the NAS.
Everything seems to work fine since this morning, damn monday morning!

Friday, free space was 2-3 TB, this morning is about 500 GB.

The NAS is configured in this way.
- Firmware version: 1.11
- 2 x HDD 6 TB (RAID 1)
- 4 Users
- 3 Network Shares
- Noone except me can access the root folder Volume_1.

While configuring network shares (1 month ago) I have selected Oplock, Map Archive and Recycle.
This morning I was afraid that one of those options could be the cause of this problem so I have deselected them all but nothing changes.

Some notes:
One folder contains a lot of subfolders with very long names, it is hard also to read the properties to calculate the true dimension of the folder. For years this was not a problem so I don't think this is the cause, but maybe it's important.
But Acronis True Image make an image of the NAS every saturday nad the image file dimension is about 3 TB.

Since Saturday until now, what can be happened to make the NAS so full?

[ivan]

Is the NAS connected to the internet?  If so, is it a direct connection or one through a router with a firewall?

If the answer to the first question is 'yes' then you have a NAS that is being used to store warez or videos.  You can check by doing a dir compare between what you have now and the last backup.

If all else fails, since you have a very recent backup, reformat the the disks and restore from that backup. also make sure that if the NAS has an internet connection that there is an active firewall between it the the outside world and that you have logging active on the NAS and the firewall (activate the email log on the NAS to your admin email that will tell if there are large dumps to the NAS).

Good hunting. 

edit to try and make it clearer.

[emme]

I will now try what you have suggested, thank you very much ivan!

The NAS is connected to internet directly. No firewall, just a switch between the NAS and the Modem.

There are no multimedia files of something like this, it is a NAS used in the office and there are only documents and the TIB images of every pc (5) that daily backup themeselves with Acronis True Image.

The structure is:

Volume_1
 | - Work Folder
 | - Backup
 | - Personal Folder

These 3 folders are 3 network shares.
Every PC see the Work folder as a map shared drive, noone see the backup folder because when Acronis start it connects to that folder itself, and just one person see the personal folder.

I have freed about 600 gb of space deleting the content of the recycle in Volume_1.
But to free this space I had to use Linux: using Windows I didn't see the .recycle folder. Using the file explorer of the nas I only see a .recycle under "Work Folder -> .recycle".
With Linux, I had been able to see a .recycle folder that was in "Volume_1 -> .recycle" that was 600 gb. Is that normal ? Why the only way to see that folder was using Linux? Where am I doing wrong ?

I hope that I more or less explained the situation... I speak English like my 8month daughter speak Italian...  :\

[ivan]

Your English is quite good, much better than my Italian.

Now a couple of points.
1) Your NAS should be behind a firewall if only to stop someone reading all the business papers.  There are people that go looking for computers and NAS boxes that are open to the world, before I retired I used to see any thing up to 100 attempts to get into our company NAS boxes a day. My firewall logs show almost as many attempts on my home network.

2) If you have the recycle bin active and the people using the NAS move a lot of files then the that folder will get full.  Depending on the operating system everyone uses it may be faster or slower.  For example, at work we used OS/2 which does not support the recycle bin function so that folder was never used.  I have found people with a very full recycle folder because their operating system was Windows.

The reason I didn't mention that was because you said the loss of free space took place over the weekend.  Every time I have seen that  it has been because the NAS has been hacked and the hacker was storing data on the NAS with the files marked as hidden so anyone using Windows wouldn't see them - it is an old trick that works about 98% of the time. It doesn't work when someone uses Linux with the file viewer set to see all files r,h,s.a. The reason you didn't see the recycle in the root of Volume_1 was because it was hidden.  I have never seen seen it in the root as a hidden folder. Did you check what the files were that were in there before you deleted them?  If so, were they files you would expect to see?

One last thing at this time. Please be safe and put the NAS behind a firewall, it can still be accessed from the outside for selected people using the firewall rules but block all other access especially if you don't want business information spread around the net.
 

[emme]

1) Your NAS should be behind a firewall if only to stop someone reading all the business papers.  There are people that go looking for computers and NAS boxes that are open to the world, before I retired I used to see any thing up to 100 attempts to get into our company NAS boxes a day. My firewall logs show almost as many attempts on my home network.

I agree, we will buy one. Can you suggest me some model that is not too much expensive?
By the way, looking at the log I don't think there are suspicious connection attempts...
https://pastebin.com/yQyc9AQZ

2) If you have the recycle bin active and the people using the NAS move a lot of files then the that folder will get full.  Depending on the operating system everyone uses it may be faster or slower.  For example, at work we used OS/2 which does not support the recycle bin function so that folder was never used.  I have found people with a very full recycle folder because their operating system was Windows.

Now I have deactivated it, I will go on searching with Linux.

The reason I didn't mention that was because you said the loss of free space took place over the weekend.  Every time I have seen that  it has been because the NAS has been hacked and the hacker was storing data on the NAS with the files marked as hidden so anyone using Windows wouldn't see them - it is an old trick that works about 98% of the time. It doesn't work when someone uses Linux with the file viewer set to see all files r,h,s.a. The reason you didn't see the recycle in the root of Volume_1 was because it was hidden.  I have never seen seen it in the root as a hidden folder. Did you check what the files were that were in there before you deleted them?  If so, were they files you would expect to see?

All files seems to be in the right place and there is nothing strange... but I will keep going on to search.

[ivan]

Regarding the firewall, I use a Dell branded Sonicwall SOHO unit rescued from a client that upgraded to their switch with built in firewall (available from Amazon at about €569).  I have also setup a friend who has an extensive home LAN with a Ubiquiti USG  unit.  It is small but does the job (also available from Amazon as Ubiquiti Networks USG for €115).  There are other units from these and other manufacturers but these are the ones I have experience with (we also used the Dell SonicWall at work).

With the other items, you are doing the right thing in monitoring the NAS.  It might also be a good idea to activate the e-mail reporting function and have the e-mails sent to your admin e-mail (I get an e-mail from all of my NAS boxes every morning which allows quick checking for anomalies. Example mail below.

Space status:
Total Volume_1 space = 1474368 MBytes, Used space = 1088909 MBytes, Free space = 385458 MBytes

Sincerely,
Your DNS-323

[emme]

Hallelujah! I have solved the problem, and it was simpler than I think...

The problem was the recycle, or better, the problem was my knowledge about networks and nas(ses???).
Anyway, when I emptied the recycle I logged with my account and I saw all images of my pc made with Acronis (maybe, seeing that only my pc images was in the recycle should be an alert............................. shame on me!).
So I logged using Linux with every user and I found many Acronis images! So now everything has back to normal!!!

I have a question.
When I enter the NAS using a browser, in the file explorer I see:

Code: [Select]

Volume_1
|- Work folder
|- Backup
|- Private folder

Using Linux if I enter the NAS folder what I see is:

Code: [Select]

Backup
Work Folder
Recycle Bin - Volume_1
Private Folder
Volume_1

https://postimg.cc/gallery/3byttn1se/

In that recycle bin there were all files I deleted. How can be possible that the only way to see that recycle bin is using Linux?
When I created the Network Shares (Work, Private, Backup), I thought that every share has his own recycle, why everything goes in a general recycle that I can't see in any way? I can't everytime boot from a live linux to check if everything is normal...

@Ivan: thank you very much for you help, patience and time!

[ivan]

We never stop learning!

I am pleased you found the problem and the way to solve it, as to why it is done that way only the original firmware programmers know (it is not the way I would do it but then I have never worked in a Windows environment),

Be happy but keep checking. 

[emme]

Next step is turn back to paper and pen... 

Thank you very much again ivan!