Export failed

Fitch · Post by **Fitch** » Sun Jul 04, 2010 2:14 pm

Help!
I have recently had several vehicles broken into and the police are very happy with the recorded images.

They have of course, asked for a copy of the images.

No chance
I have ticked all the images on the events page (110 events recorded) and clicked on export: Export failed every time.

I have checked /var/cache/zoneminder/temp and it is empty.

The police come back in about 2 hours and I have nothing for them.

Paranoid · Post by **Paranoid** » Sun Jul 04, 2010 5:00 pm

Check the permissions on the temp directory. It must be writable by whatever user is running the http processes (wwrun on my system). If you are really desperate you could try changing the directory permissions to 777.

Also, are you sure you are looking in the correct directory? On mine the temporary directory for exports is located at:

ZM_PATH_WEB/temp

ZM_PATH_WEB is defined in the /etc/zm.conf file.

Fitch · Post by **Fitch** » Sun Jul 04, 2010 5:34 pm

ZM_PATH_WEB is /usr/share/zoneminder just to confuse things.
www-data has the permissions, but I've allowed read/write, create/delete files in the aforementioned directories.

Still no joy.

Is there a fault log I can look at?

Shall I change the path to /var/cache/zoneminder/temp ? as /usr/share/zoneminder is pretty full up with all sorts of stuff and /var/cache/zoneminder/temp is empty...

Fitch · Post by **Fitch** » Sun Jul 04, 2010 6:28 pm

Tried new temp directory owned by www-data.

Still no joy.

I switched additional debug on, set the level to 5 and looked at zm_debug.log and it doesn't seem to record anything about exporting.

And yes, I am really, really desperate. Forensics have just been, and I couldn't hand anything over to them.

Paranoid · Post by **Paranoid** » Sun Jul 04, 2010 8:32 pm

The path to the export directory is hard coded into the php code. Look for the directory /usr/share/zoneminder/temp which is where it will store the files to be exported.

Any errors will appear in the apache error log file

Fitch · Post by **Fitch** » Sun Jul 04, 2010 9:09 pm

I don't know what's happened
I've lost the lot.
There are now no events or archives. It's as though ZM has just been installed.

I did archive thew 110 events required by the police, but I don't know where the files are held.

Thast's it then. The two little bastards get away scot free.

Fitch · Post by **Fitch** » Sun Jul 04, 2010 9:33 pm

Where was the apache error log file anyway?
Will zmfix get the files back?
I am loathe to try as the last time I did, it did not go well.

Fitch · Post by **Fitch** » Sun Jul 04, 2010 10:04 pm

It seems to be wiping the files that were still on the drive. From 80% it is now down to 43% in a couple of hours

How do I stop it wiping the events?

The hard drive is still going.

Fitch · Post by **Fitch** » Sun Jul 04, 2010 10:06 pm

It is now down to 41%.

camroidv27 · Post by **camroidv27** » Sun Jul 04, 2010 11:05 pm

I'm sorry to hear about your loss of data so far. Working in forensics, I'd suggesting shutting down the computer and giving the hard drive to the officers, asking them to deliver it to a computer forensics department to see if they can recover the lost files. I've had to do that a few times at work when a DVR had files that were "deleted". Though, I don't know fully if linux zeros out the deleted files, or if it just marks them as deleted files... I'm in video forensics, not computer forensics and will ask my co-workers when I go back to work this week.

Anyhow, I couldn't export to a zip file until I installed the zip package on my ubuntu box.

Code: Select all

sudo apt-get install zip

did the trick.

Paranoid · Post by **Paranoid** » Mon Jul 05, 2010 12:11 am

If there is still time then kill the zmaudit process.

My guess is that you changed the setting for where the event images are stored (DIR_EVENTS) and zmaudit then ran and deleted all the event entries from the database because it could not find the events. You then changed it back and zmaudit started deleting the events because there was no longer any matching database entries.

The apache config file(s) should tell you where its error file is located.

Fitch · Post by **Fitch** » Mon Jul 05, 2010 9:03 am

What would be the simplest and quickest way to kill zmaudit?

The computer was shut down yesterday, so I've got something left. Hopefully, the last few days will be the last to be deleted and I can throw all the directories straight onto a DVD and worry about the rest of the problem later.

Paranoid · Post by **Paranoid** » Mon Jul 05, 2010 9:41 am

zmaudit is controlled via the options->system menu. Look for RUN_AUDIT and AUDIT_CHECK_INTERVAL items.

You need to ensure that when you bring the computer back up it does not start the zoneminder processes otherwise it will start deleting again.

Fitch · Post by **Fitch** » Mon Jul 05, 2010 4:32 pm

Thanks everyone!
As camroid suggested, I offered the hard drive to the police and they snapped it up.
They brought a computer guy with them and he was happy to send it over to Computer Forensics.

Things were getting too complicated as I switched the computer off yesterday, only to find that the PSU had called it a day, and wouldn't switch on again this morning - guess being on for 24 hours a day, 365 days a year took it's toll on an e-machines box.

I managed to figure out the directory structure which hopefully will help them pull 3 hours worth of jpegs in 110 directories, each with an average of 30 jpg's. Good luck to them.
I don't care if I ever see that hard drive again.

I will buy another drive and PSU, reload Linux and Zoneminder and test to see if I can export files straight away.

This story hasn't finished yet Paranoid.. I will be back.....

Fitch · Post by **Fitch** » Wed Jul 07, 2010 9:57 pm

Update:

The two "perps" have been remanded in custody and appear before the beak tomorrow.

Question..
Am I going to have problems loading Zoneminder on Lucid? (it was Karmic previously)