Tar'ing /proc ???
Hi all,
I have been getting strange errors when i was trying to tar my /proc . Are there any known issues/problems when we do such a thing ? Is it supposed to work at all ?
There is no reason as to why i am doing this :-) , just wanted to try out.
TIA , for all the help
Quoted 9 lines · Linux Geek
Hi all,
I have been getting strange errors when i was trying to tar my /proc . Are there any known issues/problems when we do such a thing ? Is it supposed to work at all ?
There is no reason as to why i am doing this :-) , just wanted to try out.
TIA , for all the help
Normally, you do tar -clf
|________ stay on the same file-system.
Otherwise toy need to use --exclude /proc. Proc is a virtual file-system that contains things like kcore. You can get into a deadlock when reading kcore and you don't want this in your backup anyway.
Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips). Why is the government concerned about the lunatic fringe? Think about it.
Quoted 4 lines
Normally, you do
tar -clf|________ stay on the same file-system.Otherwise toy need to use --exclude /proc. Proc is a virtual file-system that contains things like kcore. You can get into
Well i think that besides kcore (and maybe kmem) you should be able to archive it.
Regards,
Maciej Soltysiak
Quoted 10 lines · Maciej Soltysiak
Quoted 4 lines
Normally, you do
tar -clf|________ stay on the same file-system.Otherwise toy need to use --exclude /proc. Proc is a virtual file-system that contains things like kcore. You can get into
Well i think that besides kcore (and maybe kmem) you should be able to archive it.
Regards,
Maciej Soltysiak
kmem is in /dev. It's a device you would use if you wanted to read all of kernel memory without locking problems.
If you really want to get a snapshot of kernel memory, then do cat /proc/kcore >/tmp/foo. /tmp/foo can then be manipulated. The problem is that /proc/kcore is dynamic, the mere act of 'inspecting' it modifies is. 'tar' ends up doing 'morecore', extending the break address when it encounters this large "file". This attempts to modify the kernel which has a lock because of the read. The result is a deadlock. Since cat or cp use small blocks and never have to call the kernel for additional resources, you can use them to get a snapshot.
Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips). Why is the government concerned about the lunatic fringe? Think about it.
Quoted 7 lines
the read. The result is a deadlock. Since
catorcpuse small blocks and never have to call the kernel for additional resources, you can use them to get a snapshot.
Cool , Understood now ! . Thanks a lot for the time.
Quoted 2 lines
Quoted 9 lines · Maciej Soltysiak
Quoted 6 lines
Normally, you do
tar -clf|________ stay on the same file-system.Otherwise toy need to use --exclude /proc. Proc is a virtual file-system that contains things like kcore. You can get into
Well i think that besides kcore (and maybe kmem) you should be able to archive it.
Ummm not really - consider what some of the data files disappear while tar is running (process directory tree). You may be in the process of copying the process memory space when the process exits.
Kablooie
Your current directory just disappeared, along with the other files you were going to backup.
You end up with a corrupted tar file.
I used to consider this as being possible to make a system "snapshot" for later examination... but no.
Consider that a process will change contents out from under tar as well. Since the process memory changed, you cannot get a consistant process dump.
And think about what happens when the tar starts copying itself... You can/will get another deadlock.
In fact - you may get a deadlock whenever you read process memory - that stuff can extend/contract as the system pages things in and out of memory.
Signature · 5 lines
------------------------------------------------------------------------- Jesse I Pollard, II Email: [email protected] Any opinions expressed are solely my own.
Quoted 10 lines · Richard B. Johnson
Normally, you do
tar -clf|________ stay on the same file-system.Otherwise toy need to use --exclude /proc. Proc is a virtual file-system that contains things like kcore. You can get into a deadlock when reading kcore and you don't want this in your backup anyway.
so it means, I can read /proc , write through sysctl interface but no 'copy' business ;-) .
Quoted 14 lines · Linux Geek
Quoted 10 lines · Richard B. Johnson
Normally, you do
tar -clf|________ stay on the same file-system.Otherwise toy need to use --exclude /proc. Proc is a virtual file-system that contains things like kcore. You can get into a deadlock when reading kcore and you don't want this in your backup anyway.
Quoted 2 lines
so it means, I can read /proc , write through sysctl interface but no 'copy' business ;-) .
Well you can use cp or cat because they don't use large amounts of data that gets extended by calling the kernel to set the break address (which can cause a deadlock). tar keeps allocating more memory when it reads this large 'file'.
Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips). Why is the government concerned about the lunatic fringe? Think about it.
Hi Linux Geek :)
Quoted 2 lines
I have been getting strange errors when i was trying to tar my /proc . Are there any known issues/problems when we do such a thing ?
Yes, the files under the procfs are *not* real files. I don't think
that taring /proc/kcore is a good idea, for example ;))
Quoted 1 line
Is it supposed to work at all ?
Don't think so.
Quoted 1 line
There is no reason as to why i am doing this :-) , just wanted to try out.
;))) Do any try you want with linux: if you don't do it as root,
you won't damage anything :))
Raúl