ZM deletes events by itself

[tech_fixer]

Hi Phil,
I've been running ZM version 0.9.16 beta3 for a few days, and I've notices some strange behavior.

After the system accumulates a large (5,000 plus) amount of events, it deletes them without even having one filter defined. It has happened twice already, the first time while vewing events. Now it deleted the events overnight, without any intervention.

Any insight on this weird behavior?

Regards,
Jose Rodriguez

[zoneminder]

Hi Jose,

I don't think I've seen this before. Do you know if it's deleting the events from the DB or from the filesystem? Checking zmaudit.log might tell you as it will tend to delete what's left.

Phil,

[tech_fixer]

The zmaudit.log indicates that events are deleted in the database and then they are deleted from the filesystem.

Regards,
Jose

[zoneminder]

It's a bit of a longshot but is there anything in the zmfilter-*.log files that might indicate that zmfilter.pl has deleted the events (whether correctly or incorrectly). I'm not sure what else other than zmaudit and zmfilter can actually delete events from the database.

Phil,

[russm]

I've got a similar issue but in my case the database is purged of events after a day.

I think it stems from the fact that the events directory is a mount point and the directory 'lost+found' throws zmaudit of track. See zmaudit.log extract

Filesystem monitor 'lost+found' does not exist in database, deleting
rm: cannot chdir from `.' to `/var/www/htdocs/zm/events/lost+found': Permission denied
Filesystem monitor 'usr' does not exist in database, deleting
Filesystem monitor 'tmp' does not exist in database, deleting
Filesystem monitor 'home' does not exist in database, deleting
Filesystem monitor 'sbin' does not exist in database, deleting
Filesystem monitor 'package' does not exist in database, deleting
Filesystem monitor 'etc' does not exist in database, deleting
Database monitor 'Trial2' does not exist in filesystem, deleting
Database monitor 'Trial1' does not exist in filesystem, deleting

Fortunatly is does not actually managed to delete any of theses :-)

[russm]

Update

Still doesn't like lost+found but has stopped the bounce up to root since I changed the chdir( '..' ); at line 172 zmaudit.pl to chdir( EVENT_PATH );

This is running on a Slackware 9.1 system using zm-0.9.16.

[zoneminder]

Hi Russ,

Thanks for pointing that out. I've made a change to .17 to ignore 'lost+found' and also to to an absolute chdir as you have indicated rather than a relative one.

Cheers,

Phil,