<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none;"></style> </head> <body dir="ltr"> <div id="divtagdefaultwrapper" style="font-size:11pt;color:#000000;font-family:Helvetica;" dir="ltr"> <p style="margin-top:0;margin-bottom:0">Thanks Michal, this is good to know.</p> <p style="margin-top:0;margin-bottom:0"><br> </p> <p style="margin-top:0;margin-bottom:0">Unfortunately, "dd" complains that the file is a "Stale file handle".</p> <p style="margin-top:0;margin-bottom:0"><br> </p> <p style="margin-top:0;margin-bottom:0">dd if=/proc/470/fs/27 of=/data/vmguest.img</p> <p style="margin-top:0;margin-bottom:0">dd: failed to open '/proc/470/fs/27': Stale file handle<br> </p> <p style="margin-top:0;margin-bottom:0"><br> </p> <p style="margin-top:0;margin-bottom:0">The file was on a NFS server, but the process "qemu" is running on the VM host. Duno if it makes a difference, but anyway, it seems I cannot "dd" the FD file.</p> <p style="margin-top:0;margin-bottom:0"><br> </p> <p style="margin-top:0;margin-bottom:0">I'll try a rsync of the root FS of the running guest, to "backup" as much as I can.</p> <p style="margin-top:0;margin-bottom:0"><br> </p> <p style="margin-top:0;margin-bottom:0">Nicolas<br> </p> <p style="margin-top:0;margin-bottom:0"><br> </p> <div style="color: rgb(0, 0, 0);"> <hr style="display:inline-block;width:98%" tabindex="-1"> <div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Michal Privoznik <mprivozn@redhat.com><br> <b>Sent:</b> Thursday, January 10, 2019 11:35<br> <b>To:</b> Roosen, Nicolas; libvirt-users@redhat.com<br> <b>Subject:</b> Re: [libvirt-users] VM running with storage image file deleted</font> <div> </div> </div> <div class="BodyFragment"><font size="2"><span style="font-size:11pt;"> <div class="PlainText">On 1/10/19 11:19 AM, Roosen, Nicolas wrote:<br> > Hello, I have a strange issue I'd like to have some insights on.<br> > <br> > <br> > We have 2 running VM, the storage pool is over NFS. Unfortunately, the backend storage folder has been deleted (so the image file in it as well, obviously) ...<br> > <br> > <br> > Yet, the 2 VM are still up and running, with their root filesystem being mounted "rw".<br> > <br> > <br> > - how does that work? I was expecting that with the file image being deleted, the VM would not work at all.<br> > <br> > - since the VM is still running, is there a way to create a snapshot of it in order to re-create the image file on another storage pool ? I'm currently exploring "virsh snapshot-create-as ...", but if access to the image file is needed, it will fail.<br> > <br> <br> On Linux a file is not deleted right away if there's a process that has<br> the file opened, which is your case. The deletion is deferred until the<br> last process closed the file.<br> <br> In order to rescue the file you could get the PID of qemu that still has<br> the disk open, and then find the FD corresponding to the file and with<br> some magic you should be able to recover the file:<br> <br> # pgrep qemu<br> 221472<br> <br> # ls -l /proc/221472/fd/ | grep deleted<br> lr-x------ 1 root root 64 Jan 10 11:31 29 -><br> /var/lib/libvirt/images/fd.img (deleted)<br> <br> (Here, 29 is the FD we're looking for)<br> <br> # dd if=/proc/221472/fd/29 of=blah.img<br> <br> snapshot-create-* won't work because that will instruct qemu to open the<br> file again which will fail because the filename is gone.<br> <br> Michal</div> <div class="PlainText"><br> </div> <div class="PlainText"><br> </div> <div class="PlainText"><br> </div> </span></font></div> </div> </div> </body> </html>