HELIOS Tech Info #169

“.afpDeleted” leftover files on Mac volumes

We received customer reports about files starting with “.afpDeleted*” on their server volumes, e.g.
.afpDeleted49861
.afpDeleted-558303828

Where do these files come from?
There is a UNIX program characteristic of creating a file, opening it, and then deleting it. This allows an application to have a private scratch file that cannot be accessed by any other process. It is kept open until it is no longer needed. When the file gets closed, it is automatically gone.
AFP does not have direct support for such an “open-delete” so the Mac client renames the “deleted” files that are still in use to “.afpDeleted*” and defers the deletion until it is closed.

When there are many “.afpDeleted*” files on a volume it is a sign that a client used such “delete before closing” but did not clean up properly. This may happen when a client is disconnected from the network, e.g. by power outage, or if the client falls into sleep mode for hours.

Note:
These files are not HELIOS EtherShare related because the AFP client creates them and therefore you may get such files on any AFP file server.

How to find these files?
The following commands must be called as “root”:

1. “dt find”
Using “dt” in a terminal has the benefit that these files are searched via desktop database, which is much faster than a regular UNIX “find” command.

/usr/local/helios/bin/dt find -v <VOLUMEPATH> -e .afpDeleted

For example:
$ /usr/local/helios/bin/dt find -v /data -e .afpDeleted
/data/aPath/.afpDeleted693
/data/anotherPath/.afpDeleted1190

2. Using UNIX “find”

find <VOLUMEPATH> -name .rsrc -prune -o -name '.afpDeleted*' -print

For example:
$ find /data -name .rsrc -prune -o -name '.afpDeleted*' -print
/data/aPath/.afpDeleted1334
/data/anotherPath/.afpDeleted1190

Note:
You should be careful using the commands below! An error in these calls may remove the wrong data!

How to remove these files
The following commands must be called as “root”:

1. “dt find”
Using “dt” in a terminal has the benefit that these files are searched via desktop database, which is much faster than a regular UNIX “find”.

/usr/local/helios/bin/dt find -v <VOLUMEPATH> -e .afpDeleted | (while read x; do echo "leftover file \"$x\""; done)

For example:
$ /usr/local/helios/bin/dt find -v /data -e .afpDeleted | (while read x; do echo "leftover file \"$x\""; done)
leftover file "/data/aPath/.afpDeleted693"
leftover file "/data/anotherPath/.afpDeleted1190"

This output needs to be checked and then you can later call:
/usr/local/helios/bin/dt find -v /data -e .afpDeleted | (while read x; do echo "leftover file \"$x\""; /usr/local/helios/bin/dt rm "$x"; done)
to remove the files.

2. Using UNIX “find”

find <VOLUMEPATH> -name .rsrc -prune -o -name '.afpDeleted*' -exec ls {} \;

For example:
$ find /data -name .rsrc -prune -o -name '.afpDeleted*' -exec ls {} \;
/data/aPath/.afpDeleted693
/data/anotherPath/.afpDeleted1190

To remove the files, replace “-exec ls” above with “-exec /usr/local/helios/bin/dt rm” after the output has been checked.