diskimage of running (linux) system
Hi,
Small question, i have a embedded system i want to do some testing on it.
The only problem is that I cant use encase, etc to clone the drive because if I open the machine up the warranty is voided and the system is a production machine so I would like to avoid any down time.
The system is a linux i486 system and i do have root access.
My goal is to make an image and run this in virtualization software (VMware, qemu, etc) so I can have a look around without messing things up to badly.
Any advice what the best course of action is and what tools to use to make in image (it needs to be done realtime and on cli because the system does not have X running) would be welcome.
Grts.
How about some info on the hardware ?Originally Posted by CloseCall
without knowing if it has things like
A cd drive
A cd writer
A tape drive
Floppy drive
Ethernet
USB ports
Serial/parallel ports
Raid hardware/software and if so what level is capable of
Spare ide channel
Spare scsi channel
What is it
What is the ultimate goal ie: what do you want to test
etc etc
Nobody is going to be able to give you a meaningful answer without some basic information.
ok you have a point there.
First, i do not need tools to test the image. I have those. The only thing I need is a way to make an image.
The machine has no external peripherals like cdrom, usb,etc I can mount an NFS/SMB share to write the image to.
I was thinking about using dd but i don't know if you can use that on runtime.
It seems to me that what you are proposing to do is fraught with possible problems. This is a running system so there is likely to be constant changes to the files. Any type of image you try to make on a running system will be a mixture of old and new files, which is likely to make your image unstable. You will also have problems with file permissions, who has exclusive access to a particular file that is being copied and written to at the same time, the system or the program making the image.
If you are unable to have any downtime, then this would appear to be a mission critical system. In which case there must surely be a backup that you could use, or some disk that is mirroring the main disk that you could swap for another, providing they are hotswapable. If you do not have some kind of fault tolerant system in place then why not, as if you cannot have downtime then what happens if there is a disk failure.
Other than that I really do not see a way that you can get a reliable copy of the system without minimal downtime.
Do you have netcat installed?
You can pipe dd to nc, but as previously mentioned, a "live" clone isn't the best way to go - but maybe it's the only way if you have no other bootable medium on the box and cannot open it?
Source:
dd if=/dev/sda | nc <target-system-ip> 9001
Target:
nc -l -p 9001 | dd of=/dev/sda
Once the clone is onto a drive on a suitable machine with cd/dvd/rw or whatever, then maybe VMware Convertor might do the P2V work for you? I *think* the latest version has better Linux support.
But it sounds like you have that end covered already?
thanks for the tips so far.
While my midnight snack yesterday I had an idea but I don't know if its feasible.
I probably have to accept the downtime. So what if i made a small kernel (only bare necessities) and a small ramdisk. Then edit the boot loader and let it boot from the new kernal and the ramdisk after reboot.
When in the booted ramdisk I can clone the disk and when done I can alter the bootloader once more to boot normally.
what do you guys think.. I there something is missed ?
NOTE: There is A snag, I intent to put the ramdisk on /boot. This will be the only partition mounted so i cant now clone this at boot.
Is there a way to merge it later on.because I can umount /boot during run time and clone it then.
Grts.
rescue
To clone a live embedded linux system without downtime is not trivial mainly due to difficulties in replicating internal mirroring (proc etc) as mentioned before.
I suggest that you divert networked services to a second machine, take the machine of interest down and use a rescue disk to mount an image in ram with basic functionality to mount disks and other networked machines and copy to a new disk.
One might question the reason for your enquiry. Replication of disks for forensic purposes to preserve evidence is always done with the machine powered down.
Lux sit
Posting Permissions
