Tar'ing /proc ???

Tar'ing /proc ???

[Linux Geek]

Hi all,

I have been getting strange errors when i was trying to tar my /proc . 
Are there any known issues/problems when we do such a thing ?
Is it supposed to work at all ?

There is no reason as to why i am doing this :-) , just wanted to try out.

TIA , for all the help

Re: Tar'ing /proc ???

[Richard B. Johnson]

On Thu, 16 Jan 2003, Linux Geek wrote:

> Hi all,
> 
> I have been getting strange errors when i was trying to tar my /proc . 
> Are there any known issues/problems when we do such a thing ?
> Is it supposed to work at all ?
> 
> There is no reason as to why i am doing this :-) , just wanted to try out.
> 
> TIA , for all the help

Normally, you do `tar -clf`
                        |________ stay on the same file-system.
Otherwise toy need to use --exclude /proc.  Proc is a virtual
file-system that contains things like kcore. You can get into
a deadlock when reading kcore and you don't want this in your
backup anyway.


Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
Why is the government concerned about the lunatic fringe? Think about it.

Re: Tar'ing /proc ???

[Maciej Soltysiak]

> Normally, you do `tar -clf`
>                         |________ stay on the same file-system.
> Otherwise toy need to use --exclude /proc.  Proc is a virtual
> file-system that contains things like kcore. You can get into
Well i think that besides kcore (and maybe kmem) you should be able
to archive it.

Regards,
Maciej Soltysiak

Re: Tar'ing /proc ???

[Richard B. Johnson]

On Thu, 16 Jan 2003, Maciej Soltysiak wrote:

> > Normally, you do `tar -clf`
> >                         |________ stay on the same file-system.
> > Otherwise toy need to use --exclude /proc.  Proc is a virtual
> > file-system that contains things like kcore. You can get into
> Well i think that besides kcore (and maybe kmem) you should be able
> to archive it.
> 
> Regards,
> Maciej Soltysiak
>

kmem is in `/dev`. It's a device you would use if you wanted to read
all of kernel memory without locking problems.

If you really want to get a snapshot of kernel memory, then do
cat /proc/kcore >/tmp/foo.  /tmp/foo can then be manipulated.
The problem is that /proc/kcore is dynamic, the mere act of
'inspecting' it modifies is. 'tar' ends up doing 'morecore',
extending the break address when it encounters this large "file".
This attempts to modify the kernel which has a lock because of
the read. The result is a deadlock. Since `cat` or `cp` use
small blocks and never have to call the kernel for additional
resources, you can use them to get a snapshot. 

Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
Why is the government concerned about the lunatic fringe? Think about it.

Re: Tar'ing /proc ???

[Linux Geek]

>
>
>the read. The result is a deadlock. Since `cat` or `cp` use
>small blocks and never have to call the kernel for additional
>resources, you can use them to get a snapshot. 
>  
>
Cool , Understood now ! . Thanks a lot for the time.

>  
>

Re: Tar'ing /proc ???

[Jesse Pollard]

On Thursday 16 January 2003 08:06 am, Maciej Soltysiak wrote:
> > Normally, you do `tar -clf`
> >
> >                         |________ stay on the same file-system.
> >
> > Otherwise toy need to use --exclude /proc.  Proc is a virtual
> > file-system that contains things like kcore. You can get into
>
> Well i think that besides kcore (and maybe kmem) you should be able
> to archive it.

Ummm not really - consider what some of the data files disappear while
tar is running (process directory tree). You may be in the process of
copying the process memory space when the process exits.

Kablooie

Your current directory just disappeared, along with the other files
you were going to backup.

You end up with a corrupted tar file.

I used to consider this as being possible to make a system
"snapshot" for later examination... but no.

Consider that a process will change contents out from under
tar as well. Since the process memory changed, you cannot
get a consistant process dump.

And think about what happens when the tar starts copying
itself... You can/will get another deadlock.

In fact - you may get a deadlock whenever you read process
memory - that stuff can extend/contract as the system pages
things in and out of memory.

-- 
-------------------------------------------------------------------------
Jesse I Pollard, II
Email: pollard@navo.hpc.mil

Any opinions expressed are solely my own.

Re: Tar'ing /proc ???

[Linux Geek]

Richard B. Johnson wrote:

>Normally, you do `tar -clf`
>                        |________ stay on the same file-system.
>Otherwise toy need to use --exclude /proc.  Proc is a virtual
>file-system that contains things like kcore. You can get into
>a deadlock when reading kcore and you don't want this in your
>backup anyway.
>
>
>  
>
so it means,  I can read /proc , write through sysctl interface but no 
'copy' business ;-) .

Re: Tar'ing /proc ???

[Richard B. Johnson]

On Thu, 16 Jan 2003, Linux Geek wrote:

> 
> 
> Richard B. Johnson wrote:
> 
> >Normally, you do `tar -clf`
> >                        |________ stay on the same file-system.
> >Otherwise toy need to use --exclude /proc.  Proc is a virtual
> >file-system that contains things like kcore. You can get into
> >a deadlock when reading kcore and you don't want this in your
> >backup anyway.
> >
> >
> >  
> >
> so it means,  I can read /proc , write through sysctl interface but no 
> 'copy' business ;-) .

Well you can use `cp` or `cat` because they don't use large amounts
of data that gets extended by calling the kernel to set the break
address (which can cause a deadlock). `tar` keeps allocating more
memory when it reads this large 'file'.


Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
Why is the government concerned about the lunatic fringe? Think about it.

Re: Tar'ing /proc ???

[DervishD]

    Hi Linux Geek :)

> I have been getting strange errors when i was trying to tar my /proc . 
> Are there any known issues/problems when we do such a thing ?

    Yes, the files under the procfs are *not* real files. I don't think
that taring /proc/kcore is a good idea, for example ;))

> Is it supposed to work at all ?

    Don't think so.
 
> There is no reason as to why i am doing this :-) , just wanted to try out.
 
    ;))) Do any try you want with linux: if you don't do it as root,
you won't damage anything :))

    Raúl