(xattr) files before a panic have empty extended attributes

This forum is to find answers to problems you may be having with ZEVO Community Edition.

Moderators: jhartley, MSR734, nola

(xattr) files before a panic have empty extended attributes

Post by grahamperrin » Sat Mar 16, 2013 9:18 am

Maybe not an issue with ZEVO, but for the record: two files – screenshots stored moments before a kernel panic (Shift-Command-3 with two displays) – have extended attributes that are empty:

Code: Select all
macbookpro08-centrim:~ gjp22$ ls -@aehl /Volumes/gjp22/Pictures/screen\ captures
total 37520
drwx------   4 gjp22  wheel    23B 14 Mar 18:15 .
drwx------  19 gjp22  wheel    36B  8 Mar 19:00 ..
-rw-------@  1 gjp22  wheel    15K 14 Mar 18:10 .DS_Store
   com.apple.FinderInfo     32B
-rw-r--r--@  1 gjp22  wheel   168K 14 Feb 23:17 2013-02-14 23-17-37 error 102.png
   com.apple.metadata:kMDItemScreenCaptureType     48B
   com.apple.metadata:kMDItemIsScreenCapture     42B
-rw-r--r--@  1 gjp22  wheel   170K 14 Feb 23:32 2013-02-14 23-32-51 error 102.png
   com.apple.metadata:kMDItemScreenCaptureType     48B
   com.apple.metadata:kMDItemIsScreenCapture     42B
drwxr-xr-x   2 gjp22  wheel     7B  9 Mar 10:24 Java
drwxr-xr-x   3 gjp22  wheel    36B 13 Mar 00:18 VirtualBox
-rw-r--r--@  1 gjp22  wheel   1.4M 14 Mar 17:57 screenshot 2013-03-14 at 17.54.35 (2).png
   com.apple.metadata:kMDItemScreenCaptureType      0B
   com.apple.metadata:kMDItemIsScreenCapture      0B
-rw-r--r--@  1 gjp22  wheel   1.3M 14 Mar 17:57 screenshot 2013-03-14 at 17.54.35.png
   com.apple.metadata:kMDItemIsScreenCapture      0B
   com.apple.metadata:kMDItemScreenCaptureType      0B
-rw-r--r--@  1 gjp22  wheel    86K 14 Mar 18:01 screenshot 2013-03-14 at 18.01.25.png
   com.apple.FinderInfo     32B
-rw-r--r--@  1 gjp22  wheel   342K 14 Mar 18:08 screenshot 2013-03-14 at 18.08.14.png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemIsScreenCapture     42B
   com.apple.metadata:kMDItemScreenCaptureType     48B
-rw-r--r--@  1 gjp22  wheel   349K 14 Mar 18:08 screenshot 2013-03-14 at 18.08.21.png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemScreenCaptureType     48B
   com.apple.metadata:kMDItemIsScreenCapture     42B
-rw-r--r--@  1 gjp22  wheel   861K 14 Mar 18:09 screenshot 2013-03-14 at 18.09.19.png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemScreenCaptureType     48B
   com.apple.metadata:kMDItemIsScreenCapture     42B
-rw-r--r--@  1 gjp22  wheel   1.3M 14 Mar 18:09 screenshot 2013-03-14 at 18.09.39 (2).png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemIsScreenCapture     42B
   com.apple.metadata:kMDItemScreenCaptureType     49B
-rw-r--r--@  1 gjp22  wheel   871K 14 Mar 18:09 screenshot 2013-03-14 at 18.09.39.png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemScreenCaptureType     49B
   com.apple.metadata:kMDItemIsScreenCapture     42B
-rw-r--r--@  1 gjp22  wheel   1.5M 14 Mar 18:09 screenshot 2013-03-14 at 18.09.54.png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemIsScreenCapture     42B
   com.apple.metadata:kMDItemScreenCaptureType     49B
-rw-r--r--@  1 gjp22  wheel   1.8M 14 Mar 18:10 screenshot 2013-03-14 at 18.10.04.png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemScreenCaptureType     49B
   com.apple.metadata:kMDItemIsScreenCapture     42B
-rw-r--r--@  1 gjp22  wheel   1.4M 14 Mar 18:11 screenshot 2013-03-14 at 18.11.32 (2).png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemScreenCaptureType     49B
   com.apple.metadata:kMDItemIsScreenCapture     42B
-rw-r--r--@  1 gjp22  wheel   1.1M 14 Mar 18:11 screenshot 2013-03-14 at 18.11.32.png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemScreenCaptureType     49B
   com.apple.metadata:kMDItemIsScreenCapture     42B
-rw-r--r--@  1 gjp22  wheel   1.4M 14 Mar 18:15 screenshot 2013-03-14 at 18.15.19 (2).png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemScreenCaptureType     49B
   com.apple.metadata:kMDItemIsScreenCapture     42B
-rw-r--r--@  1 gjp22  wheel   1.4M 14 Mar 18:15 screenshot 2013-03-14 at 18.15.19.png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemScreenCaptureType     49B
   com.apple.metadata:kMDItemIsScreenCapture     42B
-rw-r--r--@  1 gjp22  wheel   1.4M 14 Mar 18:15 screenshot 2013-03-14 at 18.15.44 (2).png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemIsScreenCapture     42B
   com.apple.metadata:kMDItemScreenCaptureType     49B
-rw-r--r--@  1 gjp22  wheel   1.2M 14 Mar 18:15 screenshot 2013-03-14 at 18.15.44.png
   com.apple.FinderInfo     32B
   com.apple.metadata:kMDItemScreenCaptureType     49B
   com.apple.metadata:kMDItemIsScreenCapture     42B
macbookpro08-centrim:~ gjp22$


(Then, most noticeable with Finder, various issues with the content of the directory, which made me worry about file system corruption, but those issues were transient. I might post details to a separate topic.)

/Volumes/gjp22
is my ZFS home directory, an encrypted Core Storage logical volume given to ZEVO.

Following a restart of the OS: the two screenshots were usable but still, their extended attributes are empty.

I renamed and copied both files. With copies temporarily on HFS Plus I can use fileXray …

Code: Select all
sh-3.2$ date
Sat 16 Mar 2013 14:10:42 GMT
sh-3.2$ sw_vers
ProductName:   Mac OS X
ProductVersion:   10.8.3
BuildVersion:   12D78
sh-3.2$ sudo fileXray /Volumes/disk0s3/2013-03-14\ 17-54-35\ screenshot\ 1.png
Password:
  path                 = disk0s3:/2013-03-14 17-54-35 screenshot 1.png
# Catalog File Thread Record
# Record 38 in node 1 beginning at 512-byte sector 0x1c038
  parentID             = 2
  nodeName             = 2013-03-14 17-54-35 screenshot 1.png
# Catalog File Record
# Record 13 in node 11 beginning at 512-byte sector 0x1c088
  type                 = file
  file ID              = 2029
  flags                = 0000000010000110
                       . File has a thread record in the catalog.
                       . File has extended attributes.
                       . File has date-added stored in Finder Info.
  reserved1            = 0
  createDate           = Thu Mar 14 17:54:36 2013
  contentModDate       = Thu Mar 14 20:46:04 2013
  attributeModDate     = Sat Mar 16 14:10:31 2013
  accessDate           = Sat Mar 16 14:10:31 2013
  backupDate           = 0
  # BSD Info
  ownerID              = 19236 (gjp22)
  groupID              = 20 (staff)
  adminFlags           = 00000000
  ownerFlags           = 00000000
  fileMode             = -rw-r--r--
  linkCount            = 1
  textEncoding         = 0
  reserved2            = 0
  # Finder Info
  fdType               = 0
  fdCreator            = 0
  fdFlags              = 0000000000000000
  fdLocation           = (v = 0, h = 0)
  opaque               = 0
  # Extended Finder Info
  reserved1            = 0
  date_added           = Sat Mar 16 14:10:31 2013
  extended_flags       = 0000000000000000
  reserved2            = 0
  reserved3            = 0
  # Data Fork
  logicalSize          = 1275284 bytes (1.3 MB)
  totalBlocks          = 312
  fork temperature     = no record in Hot File B-Tree
  clumpSize            = 0
  extents              =   startBlock   blockCount      % of file

                               0x9087        0x138       100.00 %

                         312 allocation blocks in 1 extents total.
                         312.00 allocation blocks per extent on an average.
  # Resource Fork
  logicalSize          = 0 bytes

# Attributes

# Attribute Key
  keyLength            = 98
  pad                  = 0
  fileID               = 2029
  startBlock           = 0
  attrNameLen          = 43
  attrName             = com.apple.metadata:kMDItemScreenCaptureType
# Attribute Data Record (Inline)
# Record 13 in node 1 beginning at 512-byte sector 0x6040
  recordType           = 0x10
  reserved[0]          = 0
  reserved[1]          = 0
  attrSize             = 0 bytes
  attrData             =
# Attribute Key
  keyLength            = 94
  pad                  = 0
  fileID               = 2029
  startBlock           = 0
  attrNameLen          = 41
  attrName             = com.apple.metadata:kMDItemIsScreenCapture
# Attribute Data Record (Inline)
# Record 13 in node 1 beginning at 512-byte sector 0x6040
  recordType           = 0x10
  reserved[0]          = 0
  reserved[1]          = 0
  attrSize             = 0 bytes
  attrData             =
sh-3.2$ clear


Code: Select all
sh-3.2$ sudo fileXray /Volumes/disk0s3/2013-03-14\ 17-54-35\ screenshot\ 2.png
  path                 = disk0s3:/2013-03-14 17-54-35 screenshot 2.png
# Catalog File Thread Record
# Record 39 in node 1 beginning at 512-byte sector 0x1c038
  parentID             = 2
  nodeName             = 2013-03-14 17-54-35 screenshot 2.png
# Catalog File Record
# Record 14 in node 11 beginning at 512-byte sector 0x1c088
  type                 = file
  file ID              = 2030
  flags                = 0000000010000110
                       . File has a thread record in the catalog.
                       . File has extended attributes.
                       . File has date-added stored in Finder Info.
  reserved1            = 0
  createDate           = Thu Mar 14 17:54:37 2013
  contentModDate       = Thu Mar 14 17:57:42 2013
  attributeModDate     = Sat Mar 16 14:10:31 2013
  accessDate           = Sat Mar 16 14:10:31 2013
  backupDate           = 0
  # BSD Info
  ownerID              = 19236 (gjp22)
  groupID              = 20 (staff)
  adminFlags           = 00000000
  ownerFlags           = 00000000
  fileMode             = -rw-r--r--
  linkCount            = 1
  textEncoding         = 0
  reserved2            = 0
  # Finder Info
  fdType               = 0
  fdCreator            = 0
  fdFlags              = 0000000000000000
  fdLocation           = (v = 0, h = 0)
  opaque               = 0
  # Extended Finder Info
  reserved1            = 0
  date_added           = Sat Mar 16 14:10:31 2013
  extended_flags       = 0000000000000000
  reserved2            = 0
  reserved3            = 0
  # Data Fork
  logicalSize          = 1450721 bytes (1.5 MB)
  totalBlocks          = 355
  fork temperature     = no record in Hot File B-Tree
  clumpSize            = 0
  extents              =   startBlock   blockCount      % of file

                               0x91bf        0x163       100.00 %

                         355 allocation blocks in 1 extents total.
                         355.00 allocation blocks per extent on an average.
  # Resource Fork
  logicalSize          = 0 bytes

# Attributes

# Attribute Key
  keyLength            = 98
  pad                  = 0
  fileID               = 2030
  startBlock           = 0
  attrNameLen          = 43
  attrName             = com.apple.metadata:kMDItemScreenCaptureType
# Attribute Data Record (Inline)
# Record 15 in node 1 beginning at 512-byte sector 0x6040
  recordType           = 0x10
  reserved[0]          = 0
  reserved[1]          = 0
  attrSize             = 0 bytes
  attrData             =
# Attribute Key
  keyLength            = 94
  pad                  = 0
  fileID               = 2030
  startBlock           = 0
  attrNameLen          = 41
  attrName             = com.apple.metadata:kMDItemIsScreenCapture
# Attribute Data Record (Inline)
# Record 15 in node 1 beginning at 512-byte sector 0x6040
  recordType           = 0x10
  reserved[0]          = 0
  reserved[1]          = 0
  attrSize             = 0 bytes
  attrData             =
sh-3.2$


Code: Select all
sh-3.2$ date
Sat 16 Mar 2013 14:11:42 GMT
sh-3.2$ sw_vers
ProductName:   Mac OS X
ProductVersion:   10.8.3
BuildVersion:   12D78
sh-3.2$ xattr -l /Volumes/disk0s3/2013-03-14\ 17-54-35\ screenshot\ 1.png
com.apple.metadata:kMDItemIsScreenCapture:
com.apple.metadata:kMDItemScreenCaptureType:
sh-3.2$ xattr -l /Volumes/disk0s3/2013-03-14\ 17-54-35\ screenshot\ 2.png
com.apple.metadata:kMDItemIsScreenCapture:
com.apple.metadata:kMDItemScreenCaptureType:


Incidentally these screenshots are the pair that are linked from the opening post under Finder eject, reconnect, panic, type 14=page fault, zpool.

A guess

Loosely speaking, maybe the operating system does not write extended attribute values until after storage of file data is complete.

I guess that:
  1. the PNG content of both files was stored successfully (the screenshots look OK in apps such as Preview; and GIMP 2.8.4 had no trouble editing one of the two (for confidentiality, I blurred a small area))
  2. then the kernel panic occurred before extended attribute values could be saved to permanent storage (in this case, ZFS).
grahamperrin Offline

User avatar
 
Posts: 1596
Joined: Fri Sep 14, 2012 10:21 pm
Location: Brighton and Hove, United Kingdom

For the casual reader

Post by grahamperrin » Sat Mar 16, 2013 9:51 am

Whilst this is potentially interesting from a troubleshooting perspective ("Why might a file stored with ZEVO have extended attributes that are empty?"), I do not treat this as a dataloss issue.

I knew that the kernel panic would occur. I used the keyboard shortcut for the pair of screenshots in the split second before the panic was expected.

I consider myself lucky to have these files. Read the panic-oriented topic alongside this topic, think of it this way:

  • ZEVO saved, to my ZFS home directory, an image of something that journaled HFS Plus could not save to system.log …

… a probable testament to:

  • the virtues of ZFS
  • the quality of ZEVO Community Edition 1.1.1
  • the quality of Apple Core Storage in OS X 10.8.3.
grahamperrin Offline

User avatar
 
Posts: 1596
Joined: Fri Sep 14, 2012 10:21 pm
Location: Brighton and Hove, United Kingdom


Return to Troubleshooting

Who is online

Users browsing this forum: bileyqrkq, ilovezfs and 0 guests

cron