ZFS intent-log recovery
After a crash, ZFS replays the intent log to complete synchronous writes. If a separate log device is missing or unreadable, zpool import -m can discard that log and make the pool importable, but recent acknowledged transactions may be lost.
Understand the symptom
Recovery determines whether the log device can be made readable, whether it was mirrored, when the last transaction group committed and which applications used synchronous writes. A readonly no-mount import can inventory the pool before any destructive import flag is considered.
What you may see
The pool labels reference a SLOG that is absent or faulted.
The log cannot be replayed after an unexpected shutdown.
The system discarded the missing log to continue.
Acknowledged synchronous transactions may have existed only in the lost log.
Protect the source
Applications may have been told those synchronous writes were durable.
Importing a pool still active elsewhere can corrupt it.
A newly initialized device does not contain the old intent log records.
Do this now
Do not use -m, -F, -X, clear or replacement commands on production.
Image the SLOG and label every data, special, cache and log vdev.
Save zpool import output, labels, host logs, topology and last shutdown history.
Record databases, NFS, VM or application services that relied on durable writes.
NEPFOSYS process
NEPFOSYS evaluates whether the original or mirrored SLOG can be read and replayed.
Labels, transaction groups and readonly import options are tested on copies.
Recovered pool data is checked for database, VM and filesystem consistency around the outage.
A clear next step
Start a case with the exact symptoms, incident timeline, prior attempts, encryption details, and the files that matter most. NEPFOSYS will route the case to the appropriate DFW intake or nationwide mail-in path.
Start with a case reviewQuestions, answered
Usually the main pool remains structurally present, but uncommitted synchronous writes may be lost after a crash.
It allows import by discarding the missing log device and its unreplayed recent transactions.
A no-mount readonly import is a safer diagnostic step, but preserve unstable devices before repeated reads.
DFW local · Nationwide mail-in