Repositories disappeared

It looks like all the repos on a gitlab repo have disappeared. When I go to the repo in the UI it shows as “No repository”. When I look at the Activity it shows activities from awhile back.

Running the following:
GitLab 13.12.15 Community Edition
Ubuntu VM on Azure.
On a self-hosted system.

I have looked at the other topics and it seems like the files are missing from the filesystem. Then I ran some of the suggestion to clean cache, etc. Now my directory shows the following:

$ sudo ls -al /data/repositories/@hashed
total 32
drwxr-s--- 8 git git 4096 Dec 27 12:52 .
drwxrws--- 4 git git 4096 Dec 10 14:54 ..
drwxr-s--- 3 git git 4096 Dec 21 12:02 4e
drwxr-s--- 3 git git 4096 Dec 10 14:54 53
drwxr-s--- 3 git git 4096 Dec 27 12:52 67
drwxr-s--- 3 git git 4096 Dec 26 18:20 6f
drwxr-s--- 3 git git 4096 Dec 26 18:20 b7
drwxr-s--- 3 git git 4096 Dec 26 18:20 f5

$cat /data/repositories/@hashed/67/06/
Unnamed repository; edit this file 'description' to name the repository

It looks like it has recovered some of the repos but doesn’t know what to do with them. Is there some documentation on how to recover from this?

I’ve also spent some time searching the logs for what happened looking to see if a repo was “removed” but didn’t see anything. Also, thinking that the system was have been compromised at the OS and that why I can’t see anything in the gitlab logs. I need to figure this out and I am not a cyber security person. Anybody ever have to look into this? I have gone through alot of log files and it’s difficult to determine whether an attack was succesful or just some random hacker running a script.

Do you have backups you can restore to a test system to troubleshoot?

Let me check with the group that handles the backups. In the application_json.log files you can search for removed to check if a project was removed. Do you know the keywords to check if files were deleted?

Afraid I do not. If they were deleted via a push or something then they wouldn’t show in the logfiles (I would think.) Only via the GUI.

You could test with a test system real quick and see what the logs say when deleting from the GUI.