server 2019 corrupt files

Tony Cable 1 Reputation point
2021-09-17T09:39:33.037+00:00

Hi

A couple of days ago, one of our file servers running server 2019 had a lockup, and upon rebooting it, a number of files (over 90%) in a shared folder seems to be corrupt. I've since done a restore, and they seem to be fine again. The error message (which i can't remember exactly off the top of my head) was the one where it says SYSTEM can't access the file (i can find the exact error message). I couldn't delete any files, nor could i restore over the top of them. The weird thing is, it was only one folder share that was corrupt. The drive contains three other shares, and they all seemed to be fine when i checked them over, so it doesn't appear to be a drive issue. It is a virtual server, running on VMware.

I need to try to get to the bottom of what caused them to corrupt, and was wondering if there is anything specific in the server logs i need to looks for. I can see some errors in the logs at the time that it happened, but not sure if they are related or relevant. One refers to having I/O errors, which seems to be relevant, and the others appear to be related to windows search.

Is there any specific places within the logs which will help me work out the root cause of the issue?

I need to report back as to the cause of the issue, and need to ensure that it's not going to happen again.

Thanks

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,451 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,108 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 39,341 Reputation points
    2021-09-17T12:12:38.127+00:00

    Hello TonyCable

    In this case I would recomment starting to collect SMB logs to check the I/O communication. But this will be an ongoing data collection for issues ongoing, not a historical record to analyze past behaviour. And it would be a bit hard since the you had restored.

    https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/troubleshooting-smb

    On the other hand, when SYSTEM account can't access, would seem that some corruption on the ACL (or someone was touching the permissions and ownership of the share properties)

    Best regards,

    0 comments
  2. Tony Cable 1 Reputation point
    2021-09-17T12:39:34.077+00:00

    Hi

    I will collect the logs now - as luck would have it, i have saved the old server in a safe area so i could refer back to it, so i have all the logs that i need.

    I've only restored the files to a new server, in case there was something on the server causing it to go wrong.

    0 comments