error in readdir: Unknown error

[moterpent]

This appears to be the same or similar to #585

Burp Server / Client v2.4.0
Client Windows Server 2019
Server Rocky Linux 9.2

...
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 692352
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 692416
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 692480
ffffffff2023-08-09 19:12:29: burp[38064] error in readdir: Unknown error
 692488

2023-08-09 19:12:29: burp[38064] Error in phase 1
2023-08-09 19:12:29: burp[38064] Phase 1 end (file system scan)

Nothing helpful in the server logs. Is there any way to get to the bottom of the path/folder/file that it's grumpy about?

There are several "WARNING: Could not stat path/filename Unknown error" messages throughout the phase 1 scan prior to failure. However, phase one doesn't seem to stop until it hits the message above. Earlier warnings seem to be on very long paths/folders/filenames (~270+ characters).

Suggestions?

[jumbo-grke]

Hello,
I have two ideas:

1. Modify the code in src/fsops.c that is logging the error to also print the path.
2. Deduce where it got to by looking in the phase1 scan file in the server side working directory.

[moterpent]

In order to do the first, I'll have to figure out how to recompile under Windows. Were it the linux instance on the server side, or were the client running under linux, that would be pretty straightforward. Will do some reading and report back.

Here are the last few lines from the phase1.gz.tmp file. I don't see anything nefarious. Maybe you can see something that I don't?

...
r0037A A IH/ B A A A PBkP A A BkkiiV Bkkic8 BkkiaI A g J A A
f0098D:/Serv1 Shares/Shares/Documents/Accounting/AR/Customer Files/Spartan Pro Nutrition, LLC/Sparton Pro Nutrition, LLC - Warehouse and Supply Agreement.pdf
r0035A A IP/ B A A A Ci A A Bkkiin Bkkiin Bkkiin A i J A A
f007FD:/Serv1 Shares/Shares/Documents/Accounting/AR/Customer Files/Spartan Pro Nutrition, LLC/~$ster Customer Information Sheet.docx
r0034A A EH/ B A A A A A A Bja87x Bja87x BjD3je A Q J A A
f0054D:/Serv1 Shares/Shares/Documents/Accounting/AR/Customer Files/Spring Tree Health LLC

[jumbo-grke]

Hello,

It would perhaps be something to do with the next entry that you can't see that it tripped over.
So, you could deduce what that would have been by looking at the original file system and the point that it looked like it got to in the manifest.
Perhaps there is something to do with permissions on the next directory.
Or perhaps you are trying to back up a remote share and it became inaccessible?

I could try to build you a debug Windows client if you like, but it might be a couple of days, since I'd have to downgrade the tools I'm using back to 2.4.0.

[moterpent]

It's beginning to look like there is some sort of file system corruption. After some digging, a neighboring folder reports the following when attempting to open:

The file or directory is corrupted and unreadable.

Looks like it's time to do a chkdsk during the maintenance window.

Is there any way to get burp to just skip these type of issues, log the event, and continue on to the next file/folder?

[jumbo-grke]

Hello,
The only way for now is to manually skip the directory with config.
But you're right, burp ought to automatically carry on with the rest of the backup if this kind of thing happens.