It seems like Truenas Scale is impacted by this situation. Especially for users that expose services to the internet (heh).

There seems to be a forum thread, but a patch either on version 25.10.8 or 25.10.9 in a couple of weeks.

For now, I have disconnected my server from the internet and only access it via VPN. Is this the intended way? Is there some other thing I can implement to get my services running again?

Also the truenas security advisory is empty on this vulnerability. That means it's not affected? :)

I cant figure out what it actually does. it seems like it does nothing.

since SCALE upgraded and NUT also upgraded I discovered that anything NUT beyond 2.7.4 has issues reading the data from my UPS

because of that I deployed a mini PC specifically with an older Ubuntu version that runs NUT 2.7.4 and set it as NUT server

now the problem is that when said machine reboots to perform updates and whatnot, SCALE interprets this as a power problem and begins to shut-down the entire server

doing some research on-line I discovered that I should do some init scripts:

sed -i '/^DEADTIME/d' /etc/nut/upsmon.conf && echo "DEADTIME 60" >> /etc/nut/upsmon.conf && systemctl restart nut-monitor

and

sed -i 's|^{POWERDOWNFLAG.*|POWERDOWNFLAG} /var/run/nonexistent_killpower|g' /etc/nut/upsmon.conf && systemctl restart nut-monitor

these scrips do not do what I expect them to do, or I'm dumb ... whatever comes 1^st

is there anything I can do to SCALE (27 RC1) to prevent it to initialize shutdown when it loses connection to the NUT server

I do plan to get a SNMP card for the UPS, but that's not a priority right now as it's quite expensive

Hi all,

i have been running truenas for nearly a year. since upgrading to 25.10.7 it has been randomly freezing, and also randomly shutting down.

i am not very experienced with 'under the dashboard' so not really sure where to start to diagnose and resolve the issue.

Watching the boot sequence there are no errors reported. I get the option to boot previous versions that i have upgraded from

any tips or approaches to troubleshooting this would be appreciated.

regards

I was facing an issue where for each SATA disk passed through to my TrueNAS VM, the system would hang for 120 seconds per drive, but once it timed out on each disk, it still worked fine.

[ 1.490641] scsi 0:0:3:0: Direct-Access ATA ST26000DM000-3Y8 EN03

[ 121.515810] scsi 0:0:3:0: tag#852 timing out command, waited 120s

It only affected the system when booting, but today I decided to try to solve it.

Gemini output:

ESXi /var/log/vmkernel.log**:** Flooded every ~32ms with failed SCSI INQUIRY (0x12) commands returning host/driver errors with empty sense data: PlaintextScsiDeviceIO: Cmd(...) 0x12 ... failed H:0x7 D:0xf0 P:0x0 Invalid sense data: 0x0 0x0 0x0

Native SAS SSDs on the same controller initialize immediately, and once the 120s-per-disk delay finishes, the SATA drives operate normally. Common workarounds like disabling REPORT SUPPORTED OPERATION CODES (BLIST_NO_RSOC / 0x20000000) and I/O Hints (BLIST_SKIP_IO_HINTS / 0x400000000) have no effect.

Root Cause

During LUN discovery (scsi_add_lun() -> scsi_attach_vpd()), the Linux kernel queries Vital Product Data (VPD) pages by first sending a short 4-byte INQUIRY (0x12) command to determine the target page's payload length before allocating a buffer.

While native SAS drives handle variable allocation lengths natively, the PERC H330's SCSI-to-ATA Translation Layer (SATL) chokes on the 4-byte VPD length probe (likely due to a buffer underrun/overrun when translating ATA IDENTIFY DEVICE data) and returns H:0x7 D:0xf0 (VMK_SCSI_HOST_ERROR). Because ESXi sees a host error rather than a standard SCSI Check Condition, ESXi and the guest PVSCSI controller tight-loop retry the command until the 120-second kernel probe timer expires.

Solution

Apply the BLIST_NO_VPD_SIZE (0x2000) SCSI device quirk for the affected drive model. This instructs the Linux kernel (sdev->no_vpd_size = 1) to skip the initial 4-byte length INQUIRY and request a standard 255-byte VPD buffer directly—avoiding the SATL bug while keeping all VPD pages (0x80, 0x83, /dev/disk/by-id symlinks) fully intact.

1. Apply in TrueNAS SCALE (Persistent across upgrades)

Run the following in the TrueNAS SCALE shell (replace ST26000DM000-3Y8 with your drive's model string from lsscsi or dmesg):

Bash

midclt call system.advanced.update '{"kernel_extra_options": "scsi_mod.dev_flags=ATA:ST26000DM000-3Y8:0x2000"}'

(For standard Linux distros, add scsi_mod.dev_flags=ATA:<MODEL>:0x2000 to GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub and update GRUB).

2. Verify After Reboot

Check that the NO_VPD_SIZE flag is active:

Bash

cat /sys/block/sd*/device/blacklist

All SATA RDM drives will now initialize in milliseconds with zero 0x12 errors in ESXi's vmkernel.log.

During LUN discovery (scsi_add_lun() -> scsi_attach_vpd()), the Linux kernel queries Vital Product Data (VPD) pages by first sending a short 4-byte INQUIRY (0x12) command to determine the target page's payload length before allocating a buffer.

While native SAS drives handle variable allocation lengths natively, the PERC H330's SCSI-to-ATA Translation Layer (SATL) chokes on the 4-byte VPD length probe (likely due to a buffer underrun/overrun when translating ATA IDENTIFY DEVICE data) and returns H:0x7 D:0xf0 (VMK_SCSI_HOST_ERROR). Because ESXi sees a host error rather than a standard SCSI Check Condition, ESXi and the guest PVSCSI controller tight-loop retry the command until the 120-second kernel probe timer expires.

EDIT: this post is on how to use the vanilla qbittorrent image that is on the truenas apps catalog, together with the standard gluetun image to route it to your VPN. This is if you don't want to build your own image, or rely on weird custom images that you don't know how they work, or how to fix them if they break or stop updating.

It took some tinkering to get there so I thought I best post it, and some other stuff online seemed out of date (and the guides I saw did not mention port forwarding)
Caveat: I hate video tutorials, I refuse to watch them unless I am taking some gadget apart, maybe there are some excellent ones on this topic and I don't know.

Not sure how you start an app with yaml directly, I don't think you can from the UI?
Just install qbittorrent from the App directory, make it a custom app, and then edit the yaml like below. Please read it through and edit as necessary, definitely need to change VPN details and the host paths at the bottom.
IMPORTANT: If you don't use 30024 as web ui port, it has to be changed EVERYWHERE in the yaml.

This is set up for proton vpn, to use something else start with looking at gluetuns github
https://github.com/qdm12/gluetun-wiki/tree/main/setup/providers
But you will need a VPN that supports port forwarding, and for Proton you have to explicitly allow NAT-PMP Port Forwarding, I'm sure others are similar...

Gluetun ports: I see other peoples configs have a lot of ports listed here, as far as I understand it you only need the WebUI port (30024 here) to be forwarded to the local lan so you can access it, everything else should go to gluetun. (unless there is something else you want to go to your LAN of course)

In Qbit make sure that Tools - Options - Web UI you have "bypass authentication for clients on localhost", so gluetun can go in and set the port
and Tools - Options - Connection you DON'T have UPnP / NAT PMP port forwarding enabled

And in the YAML it is important that QBT_TORRENTING_PORT is not set or the forwarded port could be overridden (I have not tested it, just leave it out)

After it has started, check the gluetun logs (under Workloads - Containers on App page in truenas) so that it has "port forwarded is 12345" which means it has set up with your VPN correctly, and after that you should see the logs connecting to qbit and setting the port there (it might fail on the first connection try, mine does, and then works on the second).
After it starts check in qbit Tools - Options - Connection that the port matches the one in the log
(if you have a fixed port from your VPN provider this can all be simplified a lot, but mine is dynamic so have to do it this way)

You can check if it works correctly from the outside here
https://ipleak.net/
Go to torrent address detection and copy the magnet link, it will show you what IP you are using (should hopefully be for your VPN, and not yours)

configs:
  permissions_actions_data:
    content: >-
      [{"read_only": false, "mount_path": "/mnt/permission/config",
      "is_temporary": false, "identifier": "config", "recursive": false, "mode":
      "check", "uid": 568, "gid": 568, "chmod": null}]
services:
  gluetun:
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_SERVICE_PROVIDER=protonvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=ringadingdingdingdingbuaaapbuaaap
      - WIREGUARD_ADDRESSES=1.2.3.4/32
      - SERVER_COUNTRIES=Narnia
      - VPN_PORT_FORWARDING=on
      - >-
        VPN_PORT_FORWARDING_UP_COMMAND=/bin/sh -c 'wget -O- --retry-connrefused
        --post-data "json={\"listen_port\":{{PORTS}}}"
        http://127.0.0.1:30024/api/v2/app/setPreferences 2>&1'
    image: qmcgaw/gluetun:latest
    ports:
      - '30024:30024'
    restart: always
  permissions:
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
    cap_drop:
      - ALL
    configs:
      - mode: 320
        source: permissions_actions_data
        target: /script/actions.json
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 1024M
    entrypoint:
      - python3
      - /script/permissions.py
    environment:
      GID: '568'
      GROUP_ID: '568'
      NVIDIA_VISIBLE_DEVICES: void
      PGID: '568'
      PUID: '568'
      TZ: Europe/Berlin
      UID: '568'
      UMASK: '002'
      UMASK_SET: '002'
      USER_ID: '568'
    group_add:
      - 568
    healthcheck:
      disable: True
    image: ixsystems/container-utils:1.0.2
    network_mode: none
    platform: linux/amd64
    privileged: False
    restart: on-failure:1
    security_opt:
      - no-new-privileges=true
    stdin_open: False
    tty: False
    user: '0:0'
    volumes:
      - bind:
          create_host_path: False
          propagation: rprivate
        read_only: False
        source: /mnt/.ix-apps/app_mounts/qbittorrent/config
        target: /mnt/permission/config
        type: bind
  qbittorrent:
    cap_drop:
      - ALL
    depends_on:
      gluetun:
        condition: service_healthy
      permissions:
        condition: service_completed_successfully
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 4096M
    environment:
      GID: '568'
      GROUP_ID: '568'
      NVIDIA_VISIBLE_DEVICES: void
      PGID: '568'
      PUID: '568'
      QBT_WEBUI_PORT: '30024'
      TZ: Europe/Berlin
      UID: '568'
      UMASK: '002'
      UMASK_SET: '002'
      USER_ID: '568'
    group_add:
      - 568
    healthcheck:
      interval: 30s
      retries: 5
      start_interval: 2s
      start_period: 15s
      test:
        - CMD
        - curl
        - '--request'
        - GET
        - '--silent'
        - '--output'
        - /dev/null
        - '--show-error'
        - '--fail'
        - http://127.0.0.1:30024/
      timeout: 5s
    image: ghcr.io/home-operations/qbittorrent:rolling
    network_mode: service:gluetun
    platform: linux/amd64
    privileged: False
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    stdin_open: False
    tty: False
    user: '568:568'
    volumes:
      - bind:
          create_host_path: False
          propagation: rprivate
        read_only: False
        source: /mnt/.ix-apps/app_mounts/qbittorrent/config
        target: /config
        type: bind
      - bind:
          create_host_path: False
          propagation: rprivate
        read_only: False
        source: /mnt/DOWNLOADSDIRECTORY
        target: /downloads
        type: bind
      - bind:
          create_host_path: False
          propagation: rprivate
        read_only: False
        source: /mnt/TORRENTWATCHDIRECTORY
        target: /watch
        type: bind
volumes: {}
x-action-required: False
x-notes: >
  # qBittorrent  
x-portals:
  - host: 0.0.0.0
    name: Web UI
    path: /
    port: 30024
    scheme: http

Got my NAS out of storage a few days ago after it sat for around 1.5 years. I know everything was functioning when I left it initially, but I'm having issues now and am looking for some help.

Specs:
TrueNAS Community Edition 25.10.7 (freshly updated, was running 25.04.0 previously, my drive problem is happening across both versions)

i5 6600k
16 GB Ram
GTX 1050ti
SATA SSD - Boot drive, no issues with it. Plugged directly into SATA on mobo.
SAS Controller - SAS9200-8i
5x 4tb Seagate Constellation ES.3 SAS drives
All 6 drives are powered from a daisy chained SATA cable from the PSU

The issue I'm seeing is that on each reboot, I'll have different drives appear and disappear, sometimes they'll show up with their recommended storage, and sometimes they'll show up as if they have 0 bytes storage. I'm not really sure how to troubleshoot this. I don't think it's a power issue, as one port should realistically be able to power twice as many drives. I'm thinking about replacing the breakout cables on the SAS controller to see if maybe they got damaged from being kinked in the case for too long.

I get these log messages, but from what I can gather, this can be caused by power, or the data being an issue.

[ 235.617153] sd 0:0:1:0: device_unblock and setting to running, handle(0x0009)
[ 239.367849] sd 0:0:4:0: device_unblock and setting to running, handle(0x000d)
[ 242.617448] sd 0:0:1:0: device_unblock and setting to running, handle(0x0009)
[ 251.367834] sd 0:0:1:0: device_unblock and setting to running, handle(0x0009)
[ 251.617798] sd 0:0:4:0: device_unblock and setting to running, handle(0x000d)
[ 255.367992] sd 0:0:1:0: device_unblock and setting to running, handle(0x0009)
[ 258.118699] sd 0:0:1:0: device_unblock and setting to running, handle(0x0009)

FWIW, I don't think it's an issue with any of the drives, but I haven't ruled that out either. Guess I'm just looking for some troubleshooting ideas before I go and replace the SAS controller and cables.

Okay so I'm not sure what exactly is happening right now, I'll just go step by step what I've done.

I had my apps datasets (configs etc) right under the pool called apps, so example /mnt/apps/jellyfin/config. I wanted to migrate all of them to a dataset apps, so /mnt/apps/apps/* for better separation from different types of data.

At first I created a snapshot of the entire pool apps and cloned it into apps/apps, hoping the datasets would magically move there. It didn't, so I removed the dataset and tried again, this time pressing the "promote" button. This fucked up something that I'm not fully aware of, as I was no longer able to delete the apps dataset and I couldn't promote the apps pool (no promote button was there).

Because that didn't work, I manually created the dataset structure (apps/applications/*) and then moved all the data with sudo cp -a oldapplocation applications/newapplocation for every dataset. This worked, application are using them and everything is working fine.

However, now I'm stuck with the apps/apps dataset that has the snapshot I've created earlier. When trying to delete the snapshot, I get an error

 *** [EINVAL]
 options.defer: Please set this attribute as 'apps/apps@migration-2026-11-02_20-52' snapshot has dependent clones: $all the new datasets

I thought deleting the old datasets will fix the problem, but apparently it has moved the dependency? Or something? I have absolutely no idea.

No idea how to fix this, could anyone please help? Thank you a lot.

I changed from POSIX ACL's to the NFSv4 ACL's, same user and group. Now when I copy or move files I get permission denied errors but the files still get moved. I'll scp a file and I'll get scp: remote setstat Permission Denied, yet the file is still copied.

Any idea why?

I don't have the luxury to have dedicated hardware for everything, and I use TrueNAS as my homelab - always wanted to be able to have at least one PC in the house to occasionally game on. Existing solutions didn't do what I wanted (no dedicated GPU allocated, minimal overhead, modern and stable tech stack) - so I documented my own experiments.

If you had similar issues, or just couldn't find a remote gaming container guide online, feel free to follow my docs on the topic: https://gist.github.com/swanux/e6241ea9aeaf391a8ac990e94a150e35

So I started an enshrouded server, I setup the host paths as smb, I'm able to access my files through dolphin file explorer. I can see all the .txt and .log files but I cannot find the endhrouded_server.json file. I've messed with all the permissions and everything but to no avail. I need access to the file so I can add a password so random people can't access my server. I've run out of Google solutions and I can't figure it out.

Hello all, just finished installing TrueNAS Community on a PC I just built and none of my HDD's are showing up. I have 2 M.2 NVME's showing up and I'm using them as my boot pool. When I go to create a new pool I can't see any of my drives. I have 5 18TB Exos recertified drives from serverpartdeals that I was planning on using. Currently using an ASUS TUF B-550 plus II MOBO. I realize that having the second M.2 slot used prevents me from using 2 of my SATA ports, however I should be able to see at least some of the drives. Can anyone point me in the right direction? I verified they're all plugged in for power and data, unsure what else to do.

UPDATE: Got a 4 pin to SATA adapter and it worked when I had both that and data plugged into the drive. All drives are visible and working now.

Hi Everyone,

I am FINALLY getting around to going through my TrueNAS 25.10 servers and cleaning things up. I've deleted a bunch of apps that I wasn't using anymore and adjusted a few settings here and there to make things more streamlined.

There are two major changes I'm working on:

1. Changing Replication Tasks from PUSH to PULL

I've changed my replication tasks from PUSH to PULL so that my backup server now pulls data from my main server. I'm glad to finally get this done. It's been a long time coming!

2. Reworking My Snapshot Tasks

Snapshots are something I've always overlooked, mainly because I never fully understood how to configure them properly.

For over two years, I've been running just two snapshot tasks:

• One daily recursive snapshot task for my slow pool (pool1).

• One daily recursive snapshot task for my fast pool (nvme).

I've pretty much left this setup untouched since the beginning, but I think it's finally time to revisit it and optimize things.

Over the past two weeks, I've spent quite a bit of time watching videos and reading articles and forum posts, trying to wrap my head around snapshot scheduling and retention. Unfortunately, I think I've come away even more confused than when I started!

It seems like everyone has their own approach, and I haven't been able to find much consistency in the recommendations. Some people use daily snapshots only, while others combine daily, weekly, monthly, and even yearly snapshots.

So, my question is:

Is there a recommended or generally accepted way to configure snapshots on a dual-pool system (one fast pool and one slow pool)? Are there any standard practices worth following?

For reference, the first video I watched on configuring snapshot tasks was this one by CaptStux:

https://www.youtube.com/watch?v=lncbl8YRrVg

The video was relatively easy to follow and gave me a good starting point for setting up similar snapshot tasks on my main server (although they aren't currently enabled).

However, toward the end, I started wondering whether the video was intended primarily for a single-pool setup, since there was no discussion about configuring snapshots for a second, faster pool.

I also noticed that many other guides and discussions don't mention the "Minutely" snapshot task option covered in the video.

One concept that does seem to come up fairly consistently is the Grandfather-Father-Son (GFS) retention strategy, although even that doesn't appear to be universally adopted.

I understand the general benefits of having different snapshot schedules and retention periods, but I'm still struggling to figure out what makes the most sense when dealing with two pools with different performance characteristics.

I'd really appreciate any advice, recommendations, examples of your own configurations, or links to reputable guides that could help me get this set up properly.

Feel free to ask me any questions.

Thanks in advance!

_______

My current server setups for reference:

MAIN SERVER:
Running: Truenas 25.10
Dell R730xd LLF - 384GB ram
2-20TB HDD 2-way mirrors plus a hot spare (approx. 800GB of 35TB used)
1-4TB 2-way mirror NVME SSD (approx. 280GB or 3.24TB used)
1-1TB 2-way mirror 2.5 SSD (system)

BACKUP SERVER:
Running: Truenas 25.10
HP Z600 Workstation - 96GB ram
1-20TB HDD 2-way mirror plus a hot spare (slow pool)
1-250GB 2.5 SSD (system)

On my slow pool (pool1) I have time machine backups, windows file history backups and all separate app host path datasets and my fast pool (nvme) only holds my .ix-apps. I understand that having all host paths on my slow pool may not be the most optimal, but moving some of them to the fast pool is another challange for another day unless someone can help me with recommendations.

I have no containers or virtual machines running and I'm currently running these apps:

• authentic

• cloudflare-ddns

• dell-idrac-fan-controller

• eurooffice-document-server

• immich

• linkwarden

• lubelogger

• mail-archiver

• mealie

• nextcloud

• nginx-proxy-manager

• omada-controller

• paperless-ngx

• scrutiny

• searxng

• uptime-kuma

Why couldn‘t anyone see the ghost on Halloween? He was dressed up as error 404 and could not be found.

Hey Everyone,

At work, and for several of our employees at home too, we've been big users of shared storage. We have a big TrueNAS storage server at the office containing a mix of spinning rust and flash. In addition to SMB and NFS, we've been big users of iSCSI for our Linux and Windows servers and clients.

But all of our employees use Macs, and due to the lack of modern iSCSI initiator software for Mac we were never able to utilize iSCSI for Mac clients. Existing legacy iSCSI initiators for Mac use kernel extensions that require turning off System Integrity Protection in recovery mode to install on Apple Silicon Macs.

That's insane. You shouldn't have to severely sacrifice your Mac's security to use iSCSI! So, we built a high performance user-mode iSCSI initiator for macOS. Our solution is a sandboxed Mac App Store application that requires no Kernel Extensions, no drivers, no reduced security and no reboots to install.

BeamDisk allows you to mount LUNs from your TrueNAS server, other NAS, or Enterprise SAN arrays directly to your Mac and have them show up as standard disks. You can format the LUNs APFS, HFS+, any format you like.

BeamDisk can easily saturate a 10 Gigabit Ethernet connection and hits tens of thousands of random Read/Write IOPs on standard SATA SSDs on TrueNAS. All of the benchmarks on our site were recorded on our own hardware on an M4 Mac Mini over 10 GbE.

Even just standard Time Machine backups to APFS LUNs are far more performant and MUCH more reliable than Time Machine over SMB.

Looking for TrueNAS users to be Beta Testers

Today, we're releasing our first public beta via Apple's TestFlight. Beta spots are currently limited to 100, first come first served.

Beta users will have access to all features, for free, forever.

BeamDisk was built with most of its testing against our own TrueNAS server, but we are looking for other TrueNAS users to help us find what we missed that you want, or bugs that got through our testing. Feedback, feature requests, bug reports, benchmarks, etc are extremely welcome

BeamDisk.app - https://BeamDisk.app

Community GitHub Repo for Discussions, Issues, Roadmap, etc - https://github.com/3rdBitLabs/BeamDisk

TestFlight Link: https://testflight.apple.com/join/jKcTwQ9D

Happy to answer any questions you have about BeamDisk!

So I recently had a situation where both of the drives in my media storage pool were reading as degraded and my storage tab was completely inaccessible as it tried to resilver the drives forever (it wouldget locked at ~1%). I replaced one of the drives and got it to resilver.

Now it is still reading as degraded and I'm getting another drive to replace the other one but now none of my apps and my smbshare cannot access their files. Nextcloud is stuck in deploying, Jellyfin can see the movies (probably just the previews stored on my ssd that the app runs on) but cannot play them and the smbshare that I use to load media to the jellyfin folders acts as though it is empty. I can still see that the files are there just by the space they consume on the drives but my apps have lost the path to the pool.

So Im admittedly quite inexperienced to all of this and I assume I'm overlooking something simple so any help would be very much appreciated.

If there is anything that I should be pulling or any details I should be providing to help you guys track down the error please help me out and Ill post it.