_mc

Q: Mac automatically deleting Folders from AFP-Share every Night

We had Folders dissappearing every Night on our AFP-Share, so i turned on the AFP-Log, and what i get is a user/imac deleting the two exact Folders and all of its Contents every Evening. (Yesterday at: 8:52 P.M. - Today at 8:57 P.M)

and logging out at the end?

what could this be? some kind of malware-script on the users imac?

 

[tons of logs before...]

Jun 10 20:52:16 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete 4479_0001.pdf" 0 0 0

Jun 10 20:52:16 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete .DS_Store" 0 0 0

Jun 10 20:52:16 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete Temp" 0 0 0

Jun 10 20:52:16 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete package_version" 0 0 0

Jun 10 20:52:17 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Logout rw" 0 0 0

 

[tons of logs before...]

Jun 11 20:57:11 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete Auftragsbestätigung" 0 0 0

Jun 11 20:57:11 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete .DS_Store" 0 0 0

Jun 11 20:57:11 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete Vorlagen" 0 0 0

Jun 11 20:57:11 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Logout rw" 0 0 0

iMac (27-inch Mid 2011), OS X Mountain Lion (10.8), Mountain Lion Server + Client

Posted on Jun 11, 2013 1:26 PM

Close

Q: Mac automatically deleting Folders from AFP-Share every Night

  • All replies
  • Helpful answers

  • by Topher Kessler,

    Topher Kessler Topher Kessler Jun 11, 2013 2:11 PM in response to _mc
    Level 6 (9,866 points)
    Jun 11, 2013 2:11 PM in response to _mc

    You can reference your router's DHCP leases to see what computer is being used to access your share. Additionally, you can try changing your share's access permissions (ie, passwords) to restrict access and see if that prevents this person from logging on and making alterations.

  • by jacrava,

    jacrava jacrava Jul 19, 2013 7:24 AM in response to _mc
    Level 1 (0 points)
    Jul 19, 2013 7:24 AM in response to _mc

    Same behavior since switching to Mountain Lion Server.

    Server folders and files deleted on logout without any user action.DeletedAtLogout.png

    Any Clue ?

  • by jacrava,

    jacrava jacrava Dec 12, 2013 12:30 AM in response to _mc
    Level 1 (0 points)
    Dec 12, 2013 12:30 AM in response to _mc

    Same problem again :

     

    A variable number of some of the most recent folders and their content are AUTOMATICALLY deleted from a specific container folder (always the same one) when a user logs out, without any other action by this user.

     

    The deleted folder(s) are the last one(s) in alphabetic order, meaning they were the most recently created.

    The folder names are standard "DEnnnn" (but all starting with "DE")

     

    The users involved are not always the same ones, and not suspected of doing it voluntarily.

     

    The container folder has a fancy name : "•Modèles" (• = alt + @).

    It is at the first level of a Raid 5 volume whose led indicators are all green.

    Many of the included files have accentueted characters in their name.

    The icon of this shared volume is visible on every user desktop.

     

    The most frequently involved user has a very cluttered desktop (> 200 icons !..) and generally shuts down its iMac without quitting all open applications, and not dismounting server volumes from its desktop.

     

    Could the problem be linked with the way users are logging out ?

    or the characters used in the files and folders names ?

  • by jjsc21,

    jjsc21 jjsc21 Feb 4, 2014 7:39 AM in response to _mc
    Level 1 (0 points)
    Feb 4, 2014 7:39 AM in response to _mc

    I'm having the same issue. 3 times in two months, first 2 times the deletes started at the same time as 'shutdown' was recorded on the client mac from which the delete commands were apparently issued. The third and most recent time I found that the AFP log had crashed so I had no trace.

     

    First time out the client was Snow Leopard, next time Mavericks, third time I know that 3 clients shut down that day, two Mavericks and one Snow Leopard, none of which were the first 2 to be affected.Not every client shutdown causes deletes on the server prior to logout.

     

    The server is Mountain Lion and the deletes are occuring within the first folder of a shared volume that is mounted on a thunderbolt-connected RAID5 array in good health. In my case deletes are occuring from the top alphabetically.

     

    This is of course extremely annoying even if it is a good proof of the backup regime.

     

    To everyone else with this problem, good luck!

  • by Curt Bodenstedt,

    Curt Bodenstedt Curt Bodenstedt Jul 11, 2014 12:53 AM in response to _mc
    Level 1 (5 points)
    Jul 11, 2014 12:53 AM in response to _mc

    Same over here!

     

    Mavericks Server (OS X 10.9.3; Server 3.1.2), RAID5-Share. Folders get randomly deleted by different users/IPs on logout. The deletes are occuring from the top alphabetically.

    Made a script to log the changes but can't see any relations. 

     

    Have you solved it already?

  • by Ray A,

    Ray A Ray A Sep 29, 2014 6:34 PM in response to Curt Bodenstedt
    Level 2 (265 points)
    Sep 29, 2014 6:34 PM in response to Curt Bodenstedt

    While this is a "me too" post, I can add that in my situation the server was installed on a clean drive. Additionally, it had Team Viewer (v6) running and the users were set up to have services only, but no home folder on the server.

     

    Does this match with anyone else's experiences?

  • by jacrava,

    jacrava jacrava May 8, 2015 3:05 AM in response to Ray A
    Level 1 (0 points)
    May 8, 2015 3:05 AM in response to Ray A

    On my side this automatic delete at shut down which occurred several times, never happened again after upgrading the server to Mac OS 10.10 Yosemite ...

    No explanation was ever found.

    I cross my fingers or "Je touche du bois" as we say in France ...

  • by Ray A,

    Ray A Ray A May 8, 2015 3:30 AM in response to _mc
    Level 2 (265 points)
    May 8, 2015 3:30 AM in response to _mc

    I ended up copying the contents to a fresh folder and deleting the old one. Problem hasn't occurred again. No idea of what was in that original folder (guessing something invisible) that was causing the problem.

  • by DonAtVolumeOne,

    DonAtVolumeOne DonAtVolumeOne Jul 20, 2016 5:26 PM in response to _mc
    Level 1 (4 points)
    Jul 20, 2016 5:26 PM in response to _mc

    ---