Disappearing Folders WTF?

Plex Media Server
1

Server Version#: Version 1.41.4.9463
Player Version#: Version 4.145.1
Over the last 10 days, firstly i had my complete tv folder disappear (29tb !)
And the last 5 days 3 x my movie folder had disappeared (7tb)
I have 2 backups that takes 2-3 days to restore tv folder and 20 hours to restore the movies folder .
Plex runs natively on a Qnap ts-1277, and the same NAS has all the media. I have asked this same question at Qnap with no answer or suggestions yet.
Could my Plex have been hacked and someone is forking with me ?

This might be connected - over the last several monthly Tautulli shows all outside members location as WAN: 127.0.0.1 (plex relay)
Previously it always showed the member local IP .
Am I being hacked inside plex !!

2

Do you have the server’s DEBUG logs ZIP file please?

Can’t tell anything without first looking through the activity recorded in the logs.

FWIW: 127.0.0.1 is LOOPBACK and never WAN
Do you have a proxy which might be too open ? (This would make it appear as WAN)

3

Hi Chuck , No proxy. I do have a static IP… here are logs .
Plex Media Server Logs_2025-02-22_14-32-09.zip (7.1 MB)

4

I have the 7tb of movies in another section of the same NAS , (and copies on other NAS ) I moved that in to the recreated movies folder and as moved it took seconds .

Minutes later after checking the storage number was right 6.92tb half the folders in side movies folder were gone . A few minutes late ALL gone .

5

PMS logs show the following METADATA items were deleted as part of scanner activity.

[chuck@lizum user.2025]$ grep DELE *
Plex Media Server.1.log:Feb 22, 2025 13:24:56.205 [140652952967992] INFO - Request: [192.168.1.199:58020 (Allowed Network (Subnet))] DELETE /library/metadata/500131 (13 live) #628974 TLS GZIP Signed-in Token (spikemixture) (fs max)
Plex Media Server.1.log:Feb 22, 2025 13:24:56.918 [140653399325496] INFO - Completed: [192.168.1.199:58020] 200 DELETE /library/metadata/500131 (13 live) #628974 TLS GZIP 713ms 195 bytes (pipelined: 11)
Plex Media Server.1.log:Feb 22, 2025 13:29:39.112 [140652814760760] INFO - Request: [192.168.1.199:58626 (Allowed Network (Subnet))] DELETE /library/metadata/496273 (13 live) #628e5b TLS GZIP Signed-in Token (spikemixture) (fs max)
Plex Media Server.1.log:Feb 22, 2025 13:29:40.329 [140653397216056] INFO - Completed: [192.168.1.199:58626] 200 DELETE /library/metadata/496273 (13 live) #628e5b TLS GZIP 1217ms 195 bytes (pipelined: 3)
Plex Media Server.1.log:Feb 22, 2025 13:31:01.291 [140652746566456] INFO - Request: [192.168.1.199:58692 (Allowed Network (Subnet))] DELETE /library/metadata/496279 (18 live) #630412 TLS GZIP Signed-in Token (spikemixture) (fs max)
Plex Media Server.1.log:Feb 22, 2025 13:31:02.409 [140653397216056] INFO - Completed: [192.168.1.199:58692] 200 DELETE /library/metadata/496279 (15 live) #630412 TLS GZIP 1118ms 195 bytes (pipelined: 16)
Plex Media Server.1.log:Feb 22, 2025 13:32:34.598 [140652771879736] INFO - Request: [192.168.1.199:58776 (Allowed Network (Subnet))] DELETE /library/metadata/495449 (15 live) #631152 TLS GZIP Signed-in Token (spikemixture) (fs max)
Plex Media Server.1.log:Feb 22, 2025 13:32:35.349 [140653397216056] INFO - Completed: [192.168.1.199:58776] 200 DELETE /library/metadata/495449 (15 live) #631152 TLS GZIP 750ms 195 bytes (pipelined: 5)
Plex Media Server.1.log:Feb 22, 2025 13:34:25.453 [140652769770296] INFO - Request: [192.168.1.199:58794 (Allowed Network (Subnet))] DELETE /library/metadata/495448 (14 live) #631a50 TLS GZIP Signed-in Token (spikemixture) (fs max)
Plex Media Server.1.log:Feb 22, 2025 13:34:25.807 [140653399325496] INFO - Completed: [192.168.1.199:58794] 200 DELETE /library/metadata/495448 (14 live) #631a50 TLS GZIP 354ms 195 bytes (pipelined: 48)
Plex Media Server.1.log:Feb 22, 2025 13:34:49.984 [140652769770296] INFO - Request: [192.168.1.199:58810 (Allowed Network (Subnet))] DELETE /library/metadata/500130 (21 live) #631c32 TLS GZIP Signed-in Token (spikemixture) (fs max)
Plex Media Server.1.log:Feb 22, 2025 13:34:51.507 [140653399325496] INFO - Completed: [192.168.1.199:58810] 200 DELETE /library/metadata/500130 (19 live) #631c32 TLS GZIP 1522ms 195 bytes (pipelined: 6)
Plex Media Server.1.log:Feb 22, 2025 13:35:24.414 [140652765551416] INFO - Request: [192.168.1.199:58820 (Allowed Network (Subnet))] DELETE /library/metadata/495447 (19 live) #631e0c TLS GZIP Signed-in Token (spikemixture) (fs max)
Plex Media Server.1.log:Feb 22, 2025 13:35:24.975 [140653397216056] INFO - Completed: [192.168.1.199:58820] 200 DELETE /library/metadata/495447 (19 live) #631e0c TLS GZIP 561ms 195 bytes (pipelined: 6)
Plex Media Server.log:Feb 22, 2025 13:37:40.342 [140653049330488] INFO - Request: [192.168.1.199:58838 (Allowed Network (Subnet))] DELETE /library/metadata/495445 (11 live) #64f6b8 TLS GZIP Signed-in Token (spikemixture) (fs max)
Plex Media Server.log:Feb 22, 2025 13:37:40.768 [140653399325496] INFO - Completed: [192.168.1.199:58838] 200 DELETE /library/metadata/495445 (11 live) #64f6b8 TLS GZIP 425ms 195 bytes (pipelined: 15)
Plex Media Server.log:Feb 22, 2025 13:40:09.380 [140652806409016] INFO - Request: [192.168.1.199:58850 (Allowed Network (Subnet))] DELETE /library/metadata/495442 (22 live) #663ea9 TLS GZIP Signed-in Token (spikemixture) (fs max)
Plex Media Server.log:Feb 22, 2025 13:40:10.444 [140653397216056] INFO - Completed: [192.168.1.199:58850] 200 DELETE /library/metadata/495442 (22 live) #663ea9 TLS GZIP 1063ms 195 bytes (pipelined: 25)
[chuck@lizum user.2026]$

Of the metadata items removed, This media item was deleted (the file was no longer present)

Feb 22, 2025 13:37:40.750 [140653357038392] DEBUG - Skipping over directory 'Joe Cocker/THE VERY BEST OF', as nothing has changed; removing 1 media items from map.
Feb 22, 2025 13:37:40.750 [140653357038392] DEBUG - Activity: updated activity ed350c64-c84c-4da7-a90e-6273bc2db300 - completed 74.8% - Scanning music
Feb 22, 2025 13:37:40.751 [140653357038392] DEBUG - Scanner: Processing directory /share/CACHEDEV2_DATA/MEDIA/music/Joe Cocker/Legend Essential Collection (parent: yes)
Feb 22, 2025 13:37:40.762 [140653049330488] DEBUG - [Req#64f6b8] Deleting media item 1243961.
Feb 22, 2025 13:37:40.762 [140653049330488] DEBUG - [Req#64f6b8] Was connected to metadata item 495445, count is now 0.
Feb 22, 2025 13:37:40.763 [140653049330488] DEBUG - [Req#64f6b8] Destroying metadata item 495445 (OhMyHoles 25 01 13 Roxy Muray XXX 480p)
Feb 22, 2025 13:37:40.765 [140652824578872] DEBUG - [Req#64f6b8] [LibraryTimeline] Scanner activity on section 11: 0 added, 1 deleted
Feb 22, 2025 13:37:40.768 [140653399325496] INFO - Completed: [192.168.1.199:58838] 200 DELETE /library/metadata/495445 (11 live) #64f6b8 TLS GZIP 425ms 195 bytes (pipelined: 15)
Feb 22, 2025 13:37:40.808 [140653357038392] DEBUG - Skipping over directory 'Joe Cocker/Legend Essential Collection', as nothing has changed; removing 1 media items from map.

Do you have the Library option set to allow media deletion?
Could someone have hit delete from the browser

You’re 100% certain the files are physically gone ? (as viewed in FileStation)

EDIT: Do you have automation tools which could be deleting?

6

I am sure I dont have that option “on”
There was about 5 adult stuff i removed about an hour ago.

7

I have several sync that run but am very carefull with settings .
And yes Filestation does not show them . FS and Sharefolder view is where i check the size

8

Are you using a Windows computer with the QNAP?
If so, are the drive letters mapped ?
If so – UNMAP them.

If you have cloud access (via qnap) disconnect it.

Then change EVERY password.

Whatever’s happening , let’s make certain it’s not an intrusion
(but there might be a remote/trojan bot somewhere)

You need to figure out where/how this is happening but FIRST step is to stop it.

9

When i get it back to normal I will run No HBS3 syncs for a few days and see !!
Maybe HBS has a bug . I do think it has been running when i have there issues …

10

I use regular rsync. Some of those ‘hybrid’ type apps bother me & can have too many bugs.

1 Like
11

Yes i am on a win11 PC now . Yes the drive letters are mapped
When u say cloud access . ?? What does that mean, I have internet obviously but no cloud services. except google mail .

12

I’m referring to the QNAP cloud access (remote) tools.

Do you have the QNAP configured to allow you to connect to it remotely?

13

From my phone yes

14

Turn off the MyQNAPCloud for now too.

Having complete control is more important right now.

15

Ok myqnapcloud kink is off

16

I have been have lots and lots of permsiion issues . What do recommend for media folder
and files

17

On QNAP, PMS runs as the admin user.

It doesn’t care about permissions

For all my media, which I first set by hand and now my automation maintains,

  1. log in as yourself
  2. sudo root (give it your password)

– use your volume names / directory name

cd /share/CACHEDEV2_DATA
find ./Movies ./TV ./Music  -type d -exec chmod 755 {} \;
find ./Movies ./TV ./Music -type f -exec chmod 644 {} \;

This means whichever user owns the file has RW.
Everyone else has RO.

1 Like
18

Thanks chuck, I will do what you suggested and the more i think of it that maybe HBS3 has been doing this .
One quickie. During this disappearing act I had to play with plex . It appears now I have lost my watched shows and a few just have a black box and no cover art .

19

Turn it ALL OFF. (including HBS3)

GET CONTROL

Ignore Plex. Look at the files / folders in FileStation

1 Like
20

Thanks will do .