Deleting /mail/cur backup and /home/example/cpmove_failed_mysql_dbs.[0-9]+

[GoWilkes]

I hate to ask such a stupid question, but I want to be 1000% sure that I'm not messing up.

When I changed to a new server in December 2020, the transfer of one of my big sites kept failing. So now on the new server, I have 2 directories:

/home/example/cpmove_failed_mysql_dbs.1608188441
/home/example/cpmove_failed_mysql_dbs.1608190633

Both have the same files inside:

example_db.create
example_db.sql
openfileslimit
roundcube.sql

But combined, they're about 20G!

I was going to delete them, but I see that the "last modified" dates on the directories are June 27 and June 30 (respectively). The files inside are still last modified in December 2020, but the fact that the dates changed on the directories has made me nervous. Obviously something is still touching them.

I changed the directory names 2 or 3 days ago (adding " - DELETE" to the end of the name), but see that the one still changed the last modified at 3:23am.

Am I right that I can still delete these directories?


I have a similar issue at:

/backup/weekly/2021-05-22/accounts/example/homedir/mail/cur

I don't use WHM's backup anymore, so May 22 was the last time that it ran.

I changed the directory name from "mail" to "mail - DELETE" a few days ago.

Even though it's a backup from May 22, the directory's last modified is June 30, 12:09am. And there are 61 files inside that are dated after May 22 (56 dated June 29, 2 dated June 30).

It's notable that /home/example/mail/cur (the directory that was backed up on May 22) shows a "last modified" of March 5, 2021, and the last file in it was June 8. There are only 4 files dated after May 22 in there.

I copied 4 of the files from /backup/weekly/2021-05-22/accounts/example/homedir/mail - DELETE/cur to /home/example/mail/cur, and I can confirm that they're just spam (I have my default set to deliver unrouted mail to account "example"). But the fact that they're being delivered to /backup/weekly/blahblahblah/ instead of /home/example/mail/ is a concern!

 

[cPRex]

Hey hey! If the databases on the account are working well, and you know that you'll no longer need that older backup data from the failed transfer, it's fine to delete those.

You're saying new emails are getting sent to a directory inside the main /backup? That would be something I've never heard of.

 

[GoWilkes]

You're saying new emails are getting sent to a directory inside the main /backup? That would be something I've never heard of.

I'm not positive, but yes, that's how it appears. Or appeared, rather.

Here's a weird one for you... now when I look, I see a lot of emails in /home/example/mail/cur that were NOT there before, with "last modified" dates earlier than today! When I logged in to Webmail I know for a fact that they weren't there before.

I can't explain this one. The only thing that I changed was downloading 4 emails from /backup/.../cur and uploading them to /home/example/mail/cur via FTP. But since copying files to the /backup directory seemed to cause the shift in the first place, maybe re-copying them to the original location shifted it back?

Either way, I'll watch it for a few days and delete the backup if all is well. It's nothing but spam anyway so it doesn't REALLY matter, as long as it doesn't start logging an error when it can't find the /backup/.../cur directory.

 

[cPRex]

So on my end, I really don't see how an email could get delivered to /backup, as that doesn't have the correct permissions to be written to by a user or by mail. If you see this happening still, could you make a ticket so we can check it out?

 

[GoWilkes]

As far as I can tell, it fixed itself. I don't have any new files in the /backup/ directory since yesterday, but you can see that there are a lot that are "last modified" after 5/22/2021:




And I have several new ones in the /home/ directory now:



Looking at the /backup/ directory after 5/22/2021, I have:

1 file on 5/27
1 file on 5/30
1 file on 6/9
58 files on 6/29
2 files on 6/30

So whatever caused it seems to have started on 5/27, but for some reason became more significant on 6/29. I can't think of any reason for it on my end, but I'll keep an eye on it and post back if I see new files inexplicably show up in the /backup/ directory.