User settings lost for no reason

[MidnightJava]

When it happened once, I just figured stuff happens. But now it happened again a week or so later, and I need to figure out what's going on.

A week or so ago, my user settings were completely wiped out. It's my wife's computer, and she doesn't think she did anything out of the ordinary. Repair permissions didn't help. Fortunately I have a bootable backup, thanks to CC Cloner. Booting from the backup, user settings were fine. So I restored the disk from backup, and all was well.

But now it's happened again. It happens that my wife has been not working lately, so I know for sure she didn't do anything to make this happen. Other than checking e-mail now and then, she hasn't trouched the computer for days. But suddenly this morning all her settings are wiped out.

Both times it was discovered in the morning. So I'm wondering if some batch
job is the culprit. I have CC CLoner set to do backup every day at 3:00 AM, but the problem doesn't happen every day, more like every 10 days or so. To the best of my recollection the first occurrence was Monday 21 Aug. I discovered it again today, Wed 30 Aug. I guess it's possible it occured Monday this week and we didn't notice it because of inactivity on the Mac.

But I don't have any chron jobs running weekly. Software Update runs weekly (don't know what day- the UI doesn't indicate), but it's set to get my permission for installing any updates. According to the Software Update UI, the last update was performed 2 Aug. This is acccording to the curent corrupted system and the non-corrupted system on the backup disk. Both system instances also tell me that software update checked this morning, but didn't find any updates. The timing does seem to implicate Software Update (since the failure occured on the day the weekly update check was made), but if nothing was updated, what could be the problem?

I'm at a complete loss as to what on earth is going on here. Does nayone have any ideas what might be wiping out my user settings or what I could do to try to figure it out?

I'm running OSX 10.3.9 with latest patches on a Mac Mini.

[symphonix]

A couple of thoughts:
- Check the hard drive free space.
- Perhaps you could find out exactly when the settings were changed by bringing up file-info on one of the plist files that has reverted back to default settings.
- Use /Applications/Utilities/Console to check various logs, especially system.log, daily.out and weekly.out, for anything that occurs at around the time the problem occurred. Also, there is a System Update log file in there as well. You'll find all of these in the File->Quick Open menu.
- Perhaps its CC Cloner that is in some way causing the problem. Where is it set to backup your system to?
- Are there any other applications or services that are left running overnight? Do you run an FTP, HTTP or BitTorrent service on the machine?

[MidnightJava]

Thanks for your suggestions. Here are some answers to what you've suggsted.

1. Will check hard drive space when I get home. At work now. The first time this happened, disk space on the internal drive was not an issue. Will check pList settings next time it happens. I restored the system this AM.

2. I did look in the console logs a bit before I left for work this AM. In the system log I saw an entry for 3:15 AM, which is about the time CC Cloner would have completed the daily backup. The log entry was "syslogd:restart". Does that mean anything to anyone?

3. Software update log file showed no activity since a security update was performed on 2 Aug. The settings wipe-out has happened twice since then. As I mentioned, update query was done today, bu nothing found. I can force an update query and see if anything happens.

4. CC Cloner could be the problem, since it's runnng a chron job. I'll look into it. Considerations against this, however: a) Chron job runs ever day, and the problem happened twice in 10 days. b) I've been running CC Cloner for over a year, with no problems. Haven't upgraded it or changed its configuration. I can do a manual backup and see if that causes the probem.

5. What CC Cloner does for me: I have an external Firewire drive with a Mac partition and a PC partition. Once per day, at 3:00 AM, CC Cloner does a synch from the internal HD to the Mac partition of the external drive. This routinely takes 10-15 mins. Once per month, on the first day at 4:00 AM, CC Cloner does a full backup (no synch) from the internal drive to the Mac partition of the external drive. Both CC Cloner backup operations create a bootable volume. A PC on the same network uses Rapid Backup app to backup selected files to the PC partition on the external drive. The external drive is connected via Firewire to the Mac only. The Mac shares files with the PC via LAN conection, and Rapid Backup just copies files to the appropriate mapped Mac folder. I've had this setup working for over a year. I'll check disk capacity on the internal Mac drive as as well as the external drive.

6. Servers running on the Mac:

-FTP server: puerftpd
-HTTP Server: Apache Server 1.3. Apache hosts Gallery2, an open source PHP-based app for serving photo galleries.
-HTTP Server/JSP Container: Apache Tomcat 5.5. Tomcat is not configured "behind" Apache via JK conector. I have JK connector turned off in both Apache and Tomcat, and each server listens on a different port. Tomcat hosts Apache Axis SOAP server and various web apps that I've developed while teaching myself servlet/JSP programming; but none of these have been active lately. No one has been hitting the Tomcat server for quite a while.

I'll look into the other things when I get home. In the meantime, pelase let me know if any of this gives any ideas.

[MidnightJava]

Latest update:

- Disk capacity is not an issue on either the internal or external drives. Tens of GBs available on both.

- The CCC log hsows that the backup operation just stopped on the morning that the problem occurred. There's no indication why it stopped- no error message, just stopped reporting status in the middle of the operation. I posted a message on the CCC forum, and the admin is doubtful CCC ould cause this, but suggested someone else may look into it eventually. I tend to think that whatever happened may have caused CCC backup to stop. So perhaps CCC can be a marker for when it happens, even if not the cause.

Can someone tell me what it means in actual terms for the user settings to be wiped out? What files are being changed or erased to achieve this result? How would I do this, for example, if I wanted to?

[MidnightJava]

After a couple days exchanging messages on the CCCloner forum, the consensus among the admins there is that CCCloner is not causing the user settings to be reset. However, it's possible that the problem was caused by the fact that CCCLoner was executing a backup task at the same time that the daily maintenance task was run. The maintenance tasks seem to be causing the syslogd:restart events. I've observed that entry in system.log at 3:15 every day and 5:30 on the first of the month, exactly the time that the daily and monthly periodic maintenance tasks run, according to my cron table.

This is a working theory. I've re-scheduled the CCCloner backup tasks to not coincide with any of the periodic maintenance tasks. Hopefully the user settings will not get reset again. If they do, I'll determine the time and see what clues that offers.

I do have one remaining question. I think I found the command in the daily, weekly, and monthly maintenance scripts that causes the syslogd:restart to appear in my system.log file. However, the admins at CCCloner forum seem to think it's a bit strange that I'm getting that log entry. Neither of them has the entry in their logs, although they do have the same command in their periodic maintenance scripts.

The command in question is

if [ -f /var/run/syslog.pid ]; then kill -HUP $(cat /var/run/syslog.pid | head -1); fi


Seems to me this has to be the source of the log entry. I'm not sure why the admins didn't have it; probably related to reporting parameters. Does anyone here think that the log entry is a cause for concern? Also, what are the chances that periodic maintenance scripts running at the same time as a backup are causing the user settings to get wiped out? I've posted all my periodic maintenance scripts below.

Daily scripts:

Script name: 100.clean-logs

#!/bin/sh
#
# $FreeBSD: src/etc/periodic/daily/110.clean-tmps,v 1.6.2.3 2001/07/26 09:04:14 brian Exp $
#
# Perform log directory cleaning so that long-lived systems
# don't end up with excessively old files there.
#

# If there is a global system configuration file, suck it in.
#
if [ -r /etc/defaults/periodic.conf ]
then
. /etc/defaults/periodic.conf
source_periodic_confs
fi

case "$daily_clean_logs_enable" in
[Yy][Ee][Ss])
if [ -z "$daily_clean_logs_days" ]
then
echo '$daily_clean_logs_enable is set but' \
'$daily_clean_logs_days is not'
rc=2
else
echo ""
echo "Removing old log files:"

set -f noglob
args="-atime +$daily_clean_logs_days -mtime +$daily_clean_logs_days"
[ -n "$daily_clean_logs_ignore" ] &&
args="$args "`echo " ${daily_clean_logs_ignore% }" |
sed 's/[ ][ ]*/ ! -name /g'`
case "$daily_clean_logs_verbose" in
[Yy][Ee][Ss])
print=-print;;
*)
print=;;
esac

rc=$(for dir in $daily_clean_logs_dirs
do
[ ."${dir#/}" != ."$dir" -a -d $dir ] && cd $dir && {
find -d . -type f $args -delete $print
find -d . ! -name . -type d -empty -mtime \
+$daily_clean_logs_days -delete $print
} | sed "s,^\\., $dir,"
done | tee /dev/stderr | wc -l)
[ -z "$print" ] && rc=0
[ $rc -gt 1 ] && rc=1
set -f glob
fi;;

*) rc=0;;
esac

exit $rc


Script name: 500.daily

#!/bin/sh -
#
# @(#)daily 8.2 (Berkeley) 1/25/94
#
PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin
host=`hostname -s`
bak=/var/backups

echo ""
echo "Removing scratch and junk files:"

if [ -d /var/rwho ] ; then
cd /var/rwho && {
find . ! -name . -mtime +7 -exec rm -f -- {} \; ; }
fi

# Clean up junk files.
#find / \( ! -fstype local -o -fstype rdonly \) -a -prune -o \
# \( -name '[#,]*' -o -name '.#*' -o -name a.out -o -name '*.core' \
# -o -name '*.CKP' -o -name '.emacs_[0-9]*' \) \
# -a -atime +3 -exec rm -f -- {} \;

# Clean up NFS turds. May be useful on NFS servers.
#if [ "${host}" != "localhost" ]; then
# find / -name .nfs\* -mtime +7 -exec rm -f -- {} \; -o -fstype nfs -prune
#fi

if [ -d /tmp ]; then
cd /tmp && {
find . -fstype local -type f -atime +3 -ctime +3 -exec rm -f -- {} \;
find -d . -fstype local ! -name . -type d -mtime +1 -exec rmdir -- {} \; \
>/dev/null 2>&1; }
fi

# remove system messages older than 21 days
msgs -c

if [ -f /var/account/acct ] ; then
if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi
echo ""
echo "Gathering accounting statistics:"
cd /var/account
if [ -f "acct.2${gzext}" ] ; then mv -f "acct.2${gzext}" "acct.3${gzext}" ; fi
if [ -f "acct.1${gzext}" ] ; then mv -f "acct.1${gzext}" "acct.2${gzext}" ; fi
if [ -f "acct.0${gzext}" ] ; then mv -f "acct.0${gzext}" "acct.1${gzext}" ; fi
cp -pf acct acct.0
if [ -x /usr/bin/gzip ]; then gzip -9 acct.0; fi
sa -s > /dev/null
fi

if [ -d /var/db/netinfo ]; then
echo ""
echo "Backing up NetInfo data"
cd /var/db/netinfo
for domain in *.nidb; do
domain=$(basename $domain .nidb)
server=`nicl -t localhost/$domain -statistics | grep tag | awk '{print $3}'`
if [ $server = master ] ; then nidump -r / -t localhost/$domain > $bak/$domain.nidump; fi
done
fi

echo ""
echo "Checking subsystem status:"

echo ""
echo "disks:"
df -k -l
echo ""
dump W

if [ -d /var/spool/mqueue ]; then
echo ""
echo "mail:"
mailq
fi

echo ""
echo "network:"
netstat -i

echo ""
if [ -d /var/rwho ] ; then
ruptime
fi

echo ""
echo -n "Rotating log files:"
cd /var/log
for i in system.log; do
if [ -f "${i}" ]; then
echo -n " ${i}"
if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi
if [ -f "${i}.6${gzext}" ]; then mv -f "${i}.6${gzext}" "${i}.7${gzext}"; fi
if [ -f "${i}.5${gzext}" ]; then mv -f "${i}.5${gzext}" "${i}.6${gzext}"; fi
if [ -f "${i}.4${gzext}" ]; then mv -f "${i}.4${gzext}" "${i}.5${gzext}"; fi
if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi
if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi
if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi
if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi
if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi
touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"
fi
done
if [ -f /var/run/syslog.pid ]; then kill -HUP $(cat /var/run/syslog.pid | head -1); fi
echo ""

if [ -d /var/log/httpd ]; then
echo ""
echo -n "Cleaning web server log files:"
cd /var/log/httpd && \
find . -type f -name '*_log*' -mtime +7 -exec rm -f -- {} \; >/dev/null 2>&1;
fi

if [ -f /etc/daily.local ]; then
echo ""
echo "Running daily.local:"
sh /etc/daily.local
fi

Monthly script:
Script name: 500.monthly

#!/bin/sh -
#
# @(#)monthly 8.1 (Berkeley) 6/9/93
#

PATH=/bin:/usr/bin:/sbin:/usr/sbin
host=`hostname -s`

echo ""
echo "Doing login accounting:"
if type sort>/dev/null; then
ac -p | sort -nr +1
else
ac -p
fi

echo ""
echo -n "Rotating log files:"
cd /var/log
for i in wtmp install.log; do
if [ -f "${i}" ]; then
echo -n " $i"
if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi
if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi
if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi
if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi
if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi
if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi
touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"
fi
done
if [ -f /var/run/syslog.pid ]; then kill -HUP $(cat /var/run/syslog.pid | head -1); fi
echo ""

if [ -f /etc/monthly.local ]; then
echo ""
echo "Running monthly.local:"
sh /etc/monthly.local
fi


Weekly script:
Script name: 500.weekly
#!/bin/sh -
#
# @(#)weekly 8.2 (Berkeley) 1/2/94
#

PATH=/bin:/sbin:/usr/sbin:/usr/bin:/usr/libexec
export PATH

host=`hostname -s`

if [ -x /usr/libexec/locate.updatedb ]; then
echo ""
echo "Rebuilding locate database:"
locdb=/var/db/locate.database
touch "${locdb}"; chown nobody "${locdb}"; chmod 644 "${locdb}"
echo /usr/libexec/locate.updatedb | nice -5 su -fm nobody 2>&1 | sed -e '/Permission denied/d'
chmod 444 "${locdb}"
fi

if [ -x /usr/libexec/makewhatis.local ]; then
echo ""
echo "Rebuilding whatis database:"
if [ -d /usr/X11R6/man ]; then
MANPATH=${MANPATH:-/usr/share/man:/usr/X11R6/man:/usr/local/man}
else
MANPATH=${MANPATH:-/usr/share/man:/usr/local/man}
fi

makewhatis.local "${MANPATH}"
fi

echo ""
echo -n "Rotating log files:"
cd /var/log
for i in ftp.log lookupd.log lpr.log mail.log netinfo.log hwmond.log ipfw.log; do
if [ -f "${i}" ]; then
echo -n " $i"
if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi
if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi
if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi
if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi
if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi
if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi
touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"
fi
done
if [ -f /var/run/syslog.pid ]; then kill -HUP $(cat /var/run/syslog.pid | head -1); fi
echo ""

cd /var/log/httpd
for i in access_log error_log; do
if [ -f "${i}" ]; then
echo -n " $i"
if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi
if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi
if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi
if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi
if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi
if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi
touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"
fi
done
if [ -f /var/run/httpd.pid ]; then /usr/sbin/apachectl restart; fi
echo ""

if [ -f /etc/weekly.local ]; then
echo ""
echo "Running weekly.local:"
sh /etc/weekly.local
fi


if [ -f /etc/security ]; then
echo ""
echo "Running security:"
sh /etc/security 2>&1 | sendmail root
fi