Cross-connected disk files

[GlenB]

Here's an odd thing - anyone care to speculate on the root cause?

My ESXi 3.5 host has 8-10 VMs running on it normally (Win2k3 and WinXP). Yesterday I was informed that the web server was not responding so I went to take a look at it. I RDP'd in and it seemed OK, but when I looked at the files on disk, the website content was not there. The machine has a C: drive (vmdk) that is the system disk and an E: drive data disk (vmdk) that has the website content on it.

Here's the thing -- the contents of the E: drive looked like the C: drive from one of the other machines!!! Both the original E: disk and the other C: disk are 8 Gb vmdks, not large at all. The file names in each of the different directories in the data store still look correct, prefixed with the correct machine name. The vmx file points to the right vmdk names.

Where did my E: drive go?

Regards - Glen

[AWo]

Here's the thing -- the contents of the E: drive looked like the C: drive from one of the other machines!!!

If that is the case this other machine should not be able to boot or run anymore as long as C: is the system drive on that guest. That is because E: is your data drive and should not contain any bootable things like an active boot partition, OS files, etc.

Where did my E: drive go?

Which .vmdk files are still in the Web server guest directory on the VMFS volume?

What does the hardware setup of the guest look like? Does it contain two disks and do both point to the right .vmdk? Open that .vmdk with a test editor and look to which flat file they point.

AWo

VCP 3 & 4

Author @ vmwire.net

\[:o]===\[o:]

=Would you like to have this posting as a ringtone on your cell phone?=

=Send "Posting" to 911 for only $999999,99!=

[GlenB]

From inside the running VM for the Web server, using Windows Explorer, the E: drive contained all of the files from the other machine's C: drive including the boot files and Windows directory and Program Files. PLUS, on boot up of the Web server it ran a chkdsk and found LOTS of orphaned files and incorrect directory pointers and (as chkdsk does) it created a found.000 directory with quite a few dir.0000x directories under it containing lots of files - and those files were my original E: drive contents. It therefore did not appear to me to be a replacement of the disk, but rather a flawed merge of the 2 disks. Really wierd.

But the other machine still booted and still had a C: drive that worked.

At the moment, the Web server has 2 disks only (C: and E:) and it's directory has:

Web.vmdk 8 Gb points to RW 16777216 VMFS "Web-flat.vmdk"

Web_1.vmdk 8 Gb points to RW 16777216 VMFS "Web_1-flat.vmdk"

Web-000001.vmdk 2.4 Gb points to RW 16777216 VMFSSPARSE "Web-000001-delta.vmdk"

Web_1-000001.vmdk 2.0 Gb points to RW 16777216 VMFSSPARSE "Web_1-000001-delta.vmdk"

and the other machine has only a C: drive:

DC2.vmdk 8 Gb points to RW 16777216 VMFS "DC2-flat.vmdk"

DC2-000001.vmdk 2.7 Gb points to RW 16777216 VMFSSPARSE "DC2-000001-delta.vmdk"

DC2-000003.vmdk 64 kb points to RW 16777216 VMFSSPARSE "DC2-000003-delta.vmdk"

Those all look OK to me and the referenced files exist within that directory - what do you think?

Do you think it's possible that the Snapshot Manager had some way of messing these up?

Regards - Glen

[GlenB]

Not really answered, but the issue is closed. I couldn't wait any longer in debug mode so I had to rebuild the machine. Now there's nothing to look at to try to understand what happened. Too bad.