Imaging a running Linux server

[Bill Bogstad]

On Fri, Aug 27, 2010 at 12:53 PM, Matthew Gillen <me-5yx05kfkO/aqeI1yJSURBw at public.gmane.org> wrote:
> On 08/27/2010 12:12 PM, Chris O'Connell wrote:
>> Would one need to boot up with a live disk or can the dd command image a
>> server that is up and running?
>
> The system can be up and running.  A slightly better solution would combine
> LVM snapshots and dd, in that you can do more to ensure filesystem consistency
> (less of an issue with journaled filesystems):
>  creat LVM snapshot
>  dd the snapshot
>  delete the snapshot

I do NOT recommend imaging a mounted filesystem with dd from an active
partition (and possibly a LVM snapshot of such a partition).   Even a
LVM snapshot (by itself) does not guarantee that the "on-disk" data is
in a consistent state.   Depending on the filesystem actually stored
on the partition, it may need only trivial fixups or it could be
completely useless.   According to this mailing list thread:

http://www.backupcentral.com/phpBB2/two-way-mirrors-of-external-mailing-lists-3/rsnapshot-24/flush-sync-ext3-for-lvm-snapshot-63162/

there is code in Linux so that some filesystems know about LVM
snapshots and make sure that the on-disk data is in a consistent
state.  If you are using the filesystems mentioned you
will probably be okay with with a snapshot.   A non-snapshot
partition, however, is likely to be dangerous.  If you are using a
non-journaled filesystem, it could be very dangerous.

At a minimum, I would suggest doing sanity checks on the image after
you take it to make
sure that it is useful.

Good Luck,
Bill Bogstad