In our production server we have apprx 1000 student's and teachers. Many of the have saved an individual profile / avatar picture and these pictures have been working correctly up until yesterday evening when all the <moodledata>/users -folders contents suddenly disappeared / got deleted. None of the site admins have deleted the files by hand from that very folder. We can see from our SAN-disk's log that the files were there apprx. at 8:23.50 pm but a moment later they were nowhere to be found.

My colleague took a look at the http log and saw an entry which was timed to the same time frame. It is very difficult for me to say if these two incidents are related, but our httpd.log says that there was:

[30/Aug/2007:20:23:50 +0300] "GET /moodle/course/enrol.php?id=103 HTTP/1.1" 200 5761

Quite soon after that all the pics had disappeared from the <moodledata>/users-folder. In the morning the same directory had some new folders from newly-registered moodle-users. After restoring the files from the tape we were able to see the avatar pics again. But the question remains: what on earth did delete the pics from the users/-folder?

Help appreciated!

 Olli S. / FINLAND