Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Mac automatically deleting Folders from AFP-Share every Night

We had Folders dissappearing every Night on our AFP-Share, so i turned on the AFP-Log, and what i get is a user/imac deleting the two exact Folders and all of its Contents every Evening. (Yesterday at: 8:52 P.M. - Today at 8:57 P.M)

and logging out at the end?

what could this be? some kind of malware-script on the users imac?


[tons of logs before...]

Jun 10 20:52:16 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete 4479_0001.pdf" 0 0 0

Jun 10 20:52:16 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete .DS_Store" 0 0 0

Jun 10 20:52:16 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete Temp" 0 0 0

Jun 10 20:52:16 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete package_version" 0 0 0

Jun 10 20:52:17 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Logout rw" 0 0 0


[tons of logs before...]

Jun 11 20:57:11 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete Auftragsbestätigung" 0 0 0

Jun 11 20:57:11 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete .DS_Store" 0 0 0

Jun 11 20:57:11 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Delete Vorlagen" 0 0 0

Jun 11 20:57:11 kv-server.local AppleFileServer[2311] <Info>: IP 192.168.1.50 - - "Logout rw" 0 0 0

iMac (27-inch Mid 2011), OS X Mountain Lion (10.8), Mountain Lion Server + Client

Posted on Jun 11, 2013 1:24 PM

Reply
9 replies

Dec 12, 2013 12:30 AM in response to _mc

Same problem again :


A variable number of some of the most recent folders and their content are AUTOMATICALLY deleted from a specific container folder (always the same one) when a user logs out, without any other action by this user.


The deleted folder(s) are the last one(s) in alphabetic order, meaning they were the most recently created.

The folder names are standard "DEnnnn" (but all starting with "DE")


The users involved are not always the same ones, and not suspected of doing it voluntarily.


The container folder has a fancy name : "•Modèles" (• = alt + @).

It is at the first level of a Raid 5 volume whose led indicators are all green.

Many of the included files have accentueted characters in their name.

The icon of this shared volume is visible on every user desktop.


The most frequently involved user has a very cluttered desktop (> 200 icons !..) and generally shuts down its iMac without quitting all open applications, and not dismounting server volumes from its desktop.


Could the problem be linked with the way users are logging out ?

or the characters used in the files and folders names ?

Feb 4, 2014 7:39 AM in response to _mc

I'm having the same issue. 3 times in two months, first 2 times the deletes started at the same time as 'shutdown' was recorded on the client mac from which the delete commands were apparently issued. The third and most recent time I found that the AFP log had crashed so I had no trace.


First time out the client was Snow Leopard, next time Mavericks, third time I know that 3 clients shut down that day, two Mavericks and one Snow Leopard, none of which were the first 2 to be affected.Not every client shutdown causes deletes on the server prior to logout.


The server is Mountain Lion and the deletes are occuring within the first folder of a shared volume that is mounted on a thunderbolt-connected RAID5 array in good health. In my case deletes are occuring from the top alphabetically.


This is of course extremely annoying even if it is a good proof of the backup regime.


To everyone else with this problem, good luck!

Mac automatically deleting Folders from AFP-Share every Night

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.