How DID my /var folder gets trashed?

[paulcons]

Some context first... early this morning, my cMP got maybe three fourths into booting and boom, everything just shut down. More than once. Booted into my clone, that was working. File system OK my on boot volume. BUT I did notice that /var was visible when it should not have been. Can't remember why (it was a VERY stressful day to say the last) but I rebooted that drive, same damn thing, boot failed to complete afer it clearly had gotten started. Remembered that clone had just been updated around 4:30AM (CCC auto incremental, boots the machine, runs the task, then shuts down, very cool), so whatever bad thing got copied. Spent a few hours trying every trick in my book... finally crossed my fingers and did a TM restore. Bingo, after some minor hiccups, everything seems mostly back. THEN I come across this:

Avid Users Are Suddenly Finding That Their Macs Won’t Boot

Avid video editors have started reported that when they shutdown their Macs, they will no longer boot up afterwards. It is not known exactly what is causing this issue, but it appears to be affecting older versions of Mac OS X who have the Avid Media Creator software installed.

www.bleepingcomputer.com

Well, I have no Avid anything that has ever been on this system. /var is now properly not visible.

So has this happened to anyone else? Anyone got ANY idea how this may have happened (yeah, a very tall order to say the least)?

 

[Patrice Brousseau]

Are you using some software with iLok: https://www.gearspace.com/board/music-computers/1280199-ilok-bug-killing-macs.html

 

[paulcons]

Hmmm, not that I am aware of... am on Sierra, have been for a long while. I know that I had disabled SIP for some reason or other a while back, was not sure I ever re-enabled it, but I just checked and it is enabled. Followed all the links, at least now I know my /var is protected... but I keep having this nagging thought it may not have been so yesterday... could doing a TM full restore have re-enabled it?

Can't thank you enough for pointing me to some more data acquisition. No doubt if I ever really NEED to disable SIP, I will promptly re-enable it! Of course, I have no clue at all to anything the goog may have done... one of the blames was on some update they did.

 

[chrfr]

Hmmm, not that I am aware of... am on Sierra, have been for a long while. I know that I had disabled SIP for some reason or other a while back, was not sure I ever re-enabled it, but I just checked and it is enabled. Followed all the links, at least now I know my /var is protected... but I keep having this nagging thought it may not have been so yesterday... could doing a TM full restore have re-enabled it?

Can't thank you enough for pointing me to some more data acquisition. No doubt if I ever really NEED to disable SIP, I will promptly re-enable it! Of course, I have no clue at all to anything the goog may have done... one of the blames was on some update they did.

It's got nothing to do with Avid software or iLoks. There was a bad Google Chrome auto-updater which deleted the /var symlink. Details here: https://mrmacintosh.com/google-chro...-symlink-on-non-sip-macs-causing-boot-issues/

 

[paulcons]

Indeed, I got to that link by following the link Patrice posted. My visible /var contained a lot fewer files than the correct one inside /private. Thanks god the much maligned TimeMachine saved my butt.

I THINK I had SIP disabled a while back and don't think I ever re-enabled it. BUT after the TM restore, I noticed it HAS been re-enabled (by what mechanism I know not). I'll never again turn it off and not re-enable it right away.

 

[Fishrrman]

Please read this post (here at macrumors):
#21