Yes, whole drive or partition based backups, like Clonezilla or dd, should not be done live.
Filesystem backups, like Timeshift or rsync or tar, may be able to be done live, if you take precautions.
4 Likes
Quick story about not doing a backup. On my desktop in the den, I had an external HDD
connected and stored inside the case of the PC. It was a āworkā / scratch disk which I made
a decision not to backup. After all, it was a place for temporary files and copies of files I
have stored elsewhere.
Last month I wiped out the disk by accident. How is another story. But no ābig dealā, it was
a work area.
Yet, I keep wondering what exactly did I have on the disk and was there anything on there that I wanted to save. So starting this month, I am going to start backing it up too. At the moment, not much to backup since it is almost empty.
3 Likes
It is quite OK for a user to put temporary files in /tmp ā¦ provided you have enough space. They will disappear on reboot, but OK for scratch purposes.
3 Likes
I had a āfailureā or near loss of data quite a few years backā¦ This will explain how RAID is NOT A BACKUP SOLUTION!
As most know - I run a NAS (FreeNAS / TrueNAS) and have been for some 15 yearsā¦
Anyway - I think back then I had a RAIDZ+1 of 4 x 1.5 TB HDD - one of the drives failed (2 of them were 2nd hand from e-bay)ā¦ So I decided to incrementally replace them with 2 TB drivesā¦ Easy peasy? i.e. buy them one at a timeā¦ introduce them to the RAIDZ+1
No! Instead of adding the new 2 TB drive as a striped member of the RAID set - it got appended or whatever you call it (i.e. instead of RAID - it somehow became a JBOD - Just a Bunch Of Disks) - i.e. no RAID featuresā¦ Man!
So - I ended up going out and buying 4 x 3 TB HDDs and built a new FreeNAS box with RAIDZ+1 on a spare AMD machine I had (the NAS itself is a HP N40L with AMD) - boot off USB thumb driveā¦ Copy the data over using tar / rsyncā¦
Once the data was copied back off the old shonky non-RAID storage (took several days)ā¦ Moved the 4 x 3 TB HDD and the thumb drive back into my original NAS hardwareā¦
But - yeah - nahā¦ my bk3-linux.bash script that works on my Pi3 (running Stretch - i.e. Debian 9 for armhf) doesnāt work on Trixie - i.e. Debian 13 on x86_64ā¦
Looks like itās not a āone size fits allā solutionā¦ Oh wellā¦
ā update ā
I reckon Iām going to have to backup to a local DIR on the machine - with āsudoā - then tar that up then ship the TAR to my backup serverā¦
ā update 2 ā
OK - took a bit of tweakingā¦ But it kinda works (or seems to)ā¦
Iām not concerned with system files or system restoreā¦ I just want data backed upā¦ like the thousands of SymLinks pointing to my movies and tv-showsā¦
This isnāt a DR solutionā¦
In a DR - Iād probably rebuild the system again from install mediaā¦
2 Likes
Dont want to be paranoid, but do other sites watch our content then do items on a similar idea ?
I automated Linux backups with a simple bash script and cron (and itās better than a GUI)
It is nothing like ours, but they may have got the idea from seeing our topic.
I did not find that article easy to follow. How did you rate it?
There are lots of obviously copied articles around, but I have never seen one that looked like it may have been copied from us.
2 Likes
Same here. It tries to be beginner style, but isnāt.
Copied or just inspired byā¦ ?
Donāt forget:
Imitation is the sincerest flattery.
ā Mahatma Gandhi
1 Like
Not at all. I get the newsletter from them and occasionally follow through but quite often donāt get much out of them. Keep thinking I will unsubscribeā¦.
Guess there are only so many topics you can have and not repeat often donāt know how our leader manages every week to have something new to read
Thatās because, IIUC Rescuezilla uses Clonezilla in the background to actually create the images. AIUI, Rescuezlla is essentially a GUI wrapper for Clonezilla, making it much more/simpler to use.
Ernie
4 Likes
My solution for such a situation (inadvertent disk wipes or other similar maladies) is to recover the existing data with test disk, a CLI disk recovery utility. Itās on all the versions of System Rescue Iāve ever used, and Iāve kept a copy handy for more years than I can remember. Test Disk has saved my bacon a few times, but the main reason I keep System Rescue handy is that it also includes gparted, the most excellent open source partition manager Iāve ever used, mostly because it has a GUI user interface to display the content one drive at a time, with a drop-down to choose from the drives connected to the local machine. System Rescue is a live Gentoo-based distribution, intended for use as a boot-able live image distribution that comes with a fine collection of system maintenance and recovery tools and utilities. You can see a list of what it has on itās home website (linked above). For clarity, I have absolutely no affiliation with System Rescue, other than that of a very satisfied long time user.
Ernie
7 Likes
My attempt to validate rsyncāing a live Linux and testing recovery
Validating rsync of a live system
To validate rsync on a live system we need an installed Linux.
I decided to install Peppermint/Devuan just for this purpose.
It was not a smooth installā¦ both Calamares and Peppermint have a few
rough edges. I got there after about 4 nights of struggleā¦ mainly to do with
getting Peppermint to detect my hotplug disksā¦ I intend to use a hotplug disk for
the rsync snapshot.
Snapshoting the live system
I have to mount the backup partition
root@trinity:/home/nevj# mount /dev/sdd3 /mnt
Then I make sure I have no other filesystems mounted that I would not want included in the backup
root@trinity:/home/nevj# df
Filesystem 1K-blocks Used Available Use% Mounted on
udev 32861800 0 32861800 0% /dev
tmpfs 6581492 1648 6579844 1% /run
/dev/sde7 100205396 7208148 87860916 8% /
tmpfs 5120 12 5108 1% /run/lock
tmpfs 13162980 0 13162980 0% /dev/shm
/dev/sde1 523244 10748 512496 3% /boot/efi
cgroup_root 10240 0 10240 0% /sys/fs/cgroup
tmpfs 6581492 12 6581480 1% /run/user/1000
/dev/sdd3 955666412 28 907047888 1% /mnt
That looks OK.
So we can issue the rsync command
rsync -avxHAXS --exclude={/dev/*,/proc/*,/sys/*,/run/*,/mnt/*,/media/*, /tmp/*} / /dev/sdd3
bash: rsync: command not found
Rsync is not installed. More peppermint rough edges.
root@trinity:/home/nevj# apt-get install rsync
....
Now try again
rsync -avHAXS --exclude={/dev/*,/proc/*,/sys/*,/run/*,/mnt/*,/media/*,/tmp/*} / /dev/sdd3
.....
var/tmp/
sent 6,035,001,277 bytes received 8,794,419 bytes 93,702,258.85 bytes/sec
total size is 6,425,946,641 speedup is 1.06
Let us see if it wrote anything
root@trinity:/home/nevj# ls /mnt
bin dev home lib lost+found mnt proc run srv tmp var
boot etc initrd.img lib64 media opt root sbin sys usr vmlinuz
root@trinity:/home/nevj# ls /
bin dev home lib lost+found mnt proc run srv tmp var
boot etc initrd.img lib64 media opt root sbin sys usr vmlinuz
root@trinity:/home/nevj# sync
root@trinity:/home/nevj#
It seems to have copied all the toplevel diretories.
It took only 1 minute.
A sync took about another 20 secondsā¦ so it was not quite finished when rsync returned
Recovering to a live system
What we need to do now is add a few files to the system, then shutdown amd reboot , and see if we can recover
Peppermint onto a live modified Peppermint.
We need to mount the backup directory, after a reboot
root@trinity:/home/nevj# mount /dev/sdd3 /mnt
The rsync it from the backup filesystem to /
rsync -avxHAXS --delete --filter=protect {/dev/*,/proc/*,/sys/*,/run/*,/mnt/*,/media/*,/tmp/*} /mnt /
unexpected end of filter rule: protect
rsync error: syntax or usage error (code 1) at exclude.c(1325) [client=3.2.7]
Looks like we got the syntax wrong. Several tries with --dry-run shows tha tit accepts this syntax
rsync -avxHAXS --delete --dry-run --filter=protect_{/dev/*,/proc/*,/sys/*,/run/*,/mnt/*,/media/*,/tmp/*} /mnt /
The separator between --filter=protect and the pattern {/dev/*, ....} must be an ā_ā, a blank
does not work, despite what the man page says.
OK , so I run that , without --dry-run, and what happens?
root@trinity:/home/nevj# rsync -avxHAXS --delete --filter=protect_{/dev/*,/proc/*,/sys/*,/run/*,/mnt/*,/media/*,/tmp/*} /mnt /
sending incremental file list
sent 14,259,230 bytes received 12,415 bytes 1,359,204.29 bytes/sec
total size is 6,425,946,641 speedup is 450.26
root@trinity:/home/nevj# sync
root@trinity:/home/nevj#
It brings back 12415 bytesā¦ and Peppermint is still runningā¦ I am in it editing this.
But,
- the file I removed after backup has not been restored
- the file I added after backup has not been deleted
- the file for this document has reteined its modifications done after the backup
Maybe I should reboot?
No, it is the same after a reboot.
So, lets see if the removed file is in the backup?
root@trinity:/home/nevj# mount /dev/sdd3 /mnt
root@trinity:/home/nevj# cd /mnt
root@trinity:/mnt# ls
lost+found
Oops, therre is nothing there. My mistake , I mounted the wrong partitionā¦ it should be sdc3.
root@trinity:~# mount /dev/sdc3 /mnt
root@trinity:~# cd /mnt
root@trinity:/mnt# ls
bin dev home lib lost+found mnt proc run srv tmp var
boot etc initrd.img lib64 media opt root sbin sys usr vmlinuz
root@trinity:/mnt# cd home
root@trinity:/mnt/home# ls
nevj
root@trinity:/mnt/home# cd nevj
root@trinity:/mnt/home/nevj# ls
boottime Documents fossdoc Pictures Templates
Desktop Downloads Music Public Videos
Yes , that is it, and the file boottime, that I removed from the live system after backup , is there.
So, try again with the correct partition
root@trinity:~# mount /dev/sdc3 /mnt
root@trinity:/home/nevj# rsync -avxHAXS --delete --filter=protect_{/dev/*,/proc/*,/sys/*,/run/*,/mnt/*,/media/*,/tmp/*} /mnt /
sending incremental file list
sent 14,259,230 bytes received 12,415 bytes 361,307.47 bytes/sec
total size is 6,425,946,641 speedup is 450.26
Exactly the same as previous tryā¦ it still did not work. I must have had the correct partition previously
Try without -x option ā¦ exactly the same.
I have run out of ideas , ā¦ any suggestions?
5 Likes
Iām almost 100% sure ātridgeā (heās an Aussie - infamous for causing Linus to loose free access to bitkeeper - and reverse engineering SMB) didnāt design rsync as a DR solutionā¦
It was pretty much developed as a method to sync remote repositories with the masterā¦ using crap infrastructure - so it had to be bulletproofā¦ e.g. keep AARNETās Debian mirror syncād with the masterā¦
I love rsync- couldnāt imagine my tech world without it - but - I donāt think Iād ever resort to using it as a DR solutionā¦
Others have mentioned ābackup a live systemā - thatās fairly trivial - unless youāre talking about Database serversā¦ rsync wasnāt designed to figure out the DB file and the log file should have the same āsnapshotā timeā¦ There are other tools for thatā¦
4 Likes
It is beginning to look like you are right.
Rsync does the backup fine from a live system
but
It looks like recovery has to be done using another linux and mounting both the source and destination filesystems.
unless someone can see why recovery to a live root filesystem fails?
I think it should be possible, because Timeshift does it.
I think ātimeā will take care of that as long as everything is backed up at once
But trueā¦ a big DB server needs special backupā¦ especially if it is online 24/7
3 Likes
Hi Ernie, 
You can install in on your system as well.
I installed it in on my Linux Lite PC a long time ago:
env LANG=en_GB:en apt-cache policy testdisk
testdisk:
Installed: 7.1-5build1
Candidate: 7.1-5build1
Version table:
*** 7.1-5build1 500
500 https://ftp.uni-stuttgart.de/ubuntu jammy/universe amd64 Packages
100 /var/lib/dpkg/status
Cheers from Rosika 
4 Likes
I suspect something may be wrong with the filter=ā¦
If I look at systemback, it does the restore this way:
rsync -aAXh --progress --delete --include=/{bin,boot,cdrom,dev,etc,home,lib,lib32,lib64,libx32,media,mnt,opt,proc,run,sbin,snap,srv,sys,tmp,usr,var,initrd.img,initrd.img.old,vmlinuz,vmlinuz.old} --exclude=/{*,etc/mtab,usr/local/bin/systemback.sh$([ -s $sdir/usr/local/bin/systemback.sh ] || printf _)} --exclude=/{home,media,mnt,root,run,tmp,var/cache/fontconfig,var/lib/udisks2,var/run,var/tmp}/* --exclude={$RP,lost+found} "$rp"/* $sdir && rsync -aAh --progress --exclude=/* "$rp"/ $sdir || error 13 $LINENO $rtype
So it doesnāt use the filter=ā¦ and I guess it has a reason.
What happens, if you omit the filter=ā¦ clause instead use the excludeā¦ thingie?
3 Likes
Agree! Along with photorec itās a great tool. It saved my own ass when I accidentally formatted the wrong SD card, thus erased a whole days recordingā¦
Photorec recovered everything, including some files erased much sooner, hower the filenames were lost. I had to deal with something liker recup___ named dirs and numbered filenames.
3 Likes
I know, but with my System Rescue live system, I also have all the other maintenance/recovery/management utilities it features at my disposal as well 
Ernie
5 Likes
I think in the backup procedure Iād stop the database server process, or would run a query for a dump. In my backup I do both.
2 Likes
I have to protect /proc, etc from being overwritten.
I was not sure --exclude would do thatā¦ because it details what not to copy rather than where not to write.
Now I have seen systembackās version, I am more confident , so I will try --excludeā¦ there is nothing in the backup in /proc etc, because I made it that wayā¦ so if I dont filter or exclude rsync will empty /proc etc
Thanks.
2 Likes
Absolutelyā¦ you have to stop anything that may write or delete files., if you are running rsync on a live systemās filesystem.
2 Likes