I had a issue with my laptops video card dieing. None the less thanks to a class action lawsuit and some work by Apple, I have been able to get my video card replaced for free (See: http://support.apple.com/kb/TS2377). The nicest thing is that this is costing me $0 dollars to fix and ship back to me. Which is awesome and I am glad that Apple took the initiative to investigate the issue and help their customers.
Well while I wait for that to happen, I was smart enough to use Screen Sharing which still worked to pull the logs off my system. Upon trying this I found my user accounts missing. I had the root user enabled so I was able to still get in one way. So after recreating my user for now (I could recreate from a full backup I did just days before this), I put my logs on a thumb drive so I could look at them.
This is a snippet from the logs:
2/12/11 10:12:19 PM com.apple.loginwindow[59] 2011-02-12 22:12:19.113 ManagedClient[120:903] -xaDiskDisappeared: removing external account “_amavisd” with home “/var/virusmails” from DSLocal because disk disappeared.
2/12/11 10:12:19 PM com.apple.loginwindow[59] 2011-02-12 22:12:19.116 ManagedClient[120:903] MCXCDeleteAccount(): Trying to delete user id = 83
It wasn’t able to delete the system accounts, thankfully. However it did delete my account and a postgresql user account I created. Which I should of setup as a system account in the first place. No damage was done, just the user account deleted. All my data was still there and backed up.
Managed Client is apart of the OS X and is used to manage users in a server setting. That said my system was never setup in a server setting. But if I had to guess from the error log, it appears that when it losses connection to the server with the user account data, it is auto deleting users as a security precaution. Again I don’t have server setup or use this, which means it acted on the local users when it couldn’t load the data. Not a very smart idea of Apple to allow this for the local users though.
User data for the system is kept in /var/db/dslocal, which explains this. I also had a notice about anacron not being able to find its data in /var. So I am suspecting that my /var directory went corrupted during one of the restarts I did trying to diagnose the system.
2/12/11 10:12:09 PM com.18james.anacron[78] anacron: Can’t chdir to /var/spool/anacron: No such file or directory
Luckily I can restore everything lost in there off a backup and didn’t keep anything important in var. So it isn’t a major lose and I am glad I keep backups. Unfortunately I wasn’t able to find very much information in searching around. I didn’t feel like reading Apples 294 page PDF about user management to try and see if I could find anything about it. A search of the document using some simple terms didn’t turn up anything.
As a final note, incase you are wondering, user accounts disappearing is happening to other OS X users, but none of them tried to look at the console log to see why. http://www.google.com/search?q=”mac+os+x”+user+account+disappeared