Results 1 to 7 of 7

Thread: diskimage of running (linux) system

  1. #1
    Just burned his ISO CloseCall's Avatar
    Join Date
    Feb 2006
    Posts
    11

    Default diskimage of running (linux) system

    Hi,

    Small question, i have a embedded system i want to do some testing on it.

    The only problem is that I cant use encase, etc to clone the drive because if I open the machine up the warranty is voided and the system is a production machine so I would like to avoid any down time.

    The system is a linux i486 system and i do have root access.

    My goal is to make an image and run this in virtualization software (VMware, qemu, etc) so I can have a look around without messing things up to badly.

    Any advice what the best course of action is and what tools to use to make in image (it needs to be done realtime and on cli because the system does not have X running) would be welcome.

    Grts.

  2. #2
    Developer balding_parrot's Avatar
    Join Date
    May 2007
    Posts
    3,399

    Default

    Quote Originally Posted by CloseCall View Post
    Hi,

    Small question, i have a embedded system i want to do some testing on it.

    The only problem is that I cant use encase, etc to clone the drive because if I open the machine up the warranty is voided and the system is a production machine so I would like to avoid any down time.

    The system is a linux i486 system and i do have root access.

    My goal is to make an image and run this in virtualization software (VMware, qemu, etc) so I can have a look around without messing things up to badly.

    Any advice what the best course of action is and what tools to use to make in image (it needs to be done realtime and on cli because the system does not have X running) would be welcome.

    Grts.
    How about some info on the hardware ?

    without knowing if it has things like
    A cd drive
    A cd writer
    A tape drive
    Floppy drive
    Ethernet
    USB ports
    Serial/parallel ports
    Raid hardware/software and if so what level is capable of
    Spare ide channel
    Spare scsi channel
    What is it
    What is the ultimate goal ie: what do you want to test
    etc etc

    Nobody is going to be able to give you a meaningful answer without some basic information.

  3. #3
    Just burned his ISO CloseCall's Avatar
    Join Date
    Feb 2006
    Posts
    11

    Default

    ok you have a point there.

    First, i do not need tools to test the image. I have those. The only thing I need is a way to make an image.

    The machine has no external peripherals like cdrom, usb,etc I can mount an NFS/SMB share to write the image to.

    I was thinking about using dd but i don't know if you can use that on runtime.

  4. #4
    Developer balding_parrot's Avatar
    Join Date
    May 2007
    Posts
    3,399

    Default

    It seems to me that what you are proposing to do is fraught with possible problems. This is a running system so there is likely to be constant changes to the files. Any type of image you try to make on a running system will be a mixture of old and new files, which is likely to make your image unstable. You will also have problems with file permissions, who has exclusive access to a particular file that is being copied and written to at the same time, the system or the program making the image.
    If you are unable to have any downtime, then this would appear to be a mission critical system. In which case there must surely be a backup that you could use, or some disk that is mirroring the main disk that you could swap for another, providing they are hotswapable. If you do not have some kind of fault tolerant system in place then why not, as if you cannot have downtime then what happens if there is a disk failure.

    Other than that I really do not see a way that you can get a reliable copy of the system without minimal downtime.

  5. #5
    Senior Member
    Join Date
    Jan 2006
    Posts
    1,334

    Default

    Quote Originally Posted by CloseCall View Post
    I was thinking about using dd but i don't know if you can use that on runtime.

    Do you have netcat installed?
    You can pipe dd to nc, but as previously mentioned, a "live" clone isn't the best way to go - but maybe it's the only way if you have no other bootable medium on the box and cannot open it?

    Source:
    dd if=/dev/sda | nc <target-system-ip> 9001

    Target:
    nc -l -p 9001 | dd of=/dev/sda

    Once the clone is onto a drive on a suitable machine with cd/dvd/rw or whatever, then maybe VMware Convertor might do the P2V work for you? I *think* the latest version has better Linux support.
    But it sounds like you have that end covered already?

  6. #6
    Just burned his ISO CloseCall's Avatar
    Join Date
    Feb 2006
    Posts
    11

    Default

    thanks for the tips so far.

    While my midnight snack yesterday I had an idea but I don't know if its feasible.

    I probably have to accept the downtime. So what if i made a small kernel (only bare necessities) and a small ramdisk. Then edit the boot loader and let it boot from the new kernal and the ramdisk after reboot.

    When in the booted ramdisk I can clone the disk and when done I can alter the bootloader once more to boot normally.

    what do you guys think.. I there something is missed ?

    NOTE: There is A snag, I intent to put the ramdisk on /boot. This will be the only partition mounted so i cant now clone this at boot.

    Is there a way to merge it later on.because I can umount /boot during run time and clone it then.

    Grts.

  7. #7
    Member imported_blackfoot's Avatar
    Join Date
    Jun 2007
    Posts
    386

    Default rescue

    To clone a live embedded linux system without downtime is not trivial mainly due to difficulties in replicating internal mirroring (proc etc) as mentioned before.

    I suggest that you divert networked services to a second machine, take the machine of interest down and use a rescue disk to mount an image in ram with basic functionality to mount disks and other networked machines and copy to a new disk.

    One might question the reason for your enquiry. Replication of disks for forensic purposes to preserve evidence is always done with the machine powered down.
    Lux sit

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •