Thanks to Jim Belonis, J. Dean Brock and Nick Batchelor for their replies.
The original post was:
> I am attempting to recover data from Digital UNIX 4.0b system with Advfs
> datasets. There are processes running on the system which are writing to
> log files, and all links to those log files have been deleted. The question is,
> how do I recover the data from those log files?
> lsof lists the open files, so I have inode numbers. I have been looking at the
> Advfs utilities, but the man pages don't describe the data structures
> (metadata) well enough for me to navigate. Verify only works on unmounted
> filesystems (at least non-root as the one in question is), and if the processes
> terminate, and the data only stays around as long as the process is running
> and keeps the file open.
>
>
> Otherwise, anyone know any tricks with dbx or whatever to attach to the file
> descriptors of the running process and dump the data?
>
> Any help would be greatly appreciated. Particularly pointers to
> documentation of the Advfs internal data structures.
The data was not recovered. After two days, management decided to cut losses and restart the affected processes.
J. Dean Brock suggested:
>> lsof lists the open files, so I have inode numbers.
>The inode number is also the tag number. If the file you
>are interested in has inode number N and is/was located
>in the AdvFS file system mounted as /ADVFS-MNT-PNT,
>you may be able to access the file as
> /ADVFS-MNT-PNT/.tags/N
>You must be logged it as root in order to do this.
While this works while there is a link to the inode/tag, it fails after the last link is deleted.
Jim Belonis suggested:
>I understand the place to start is with the DEC utility called 'salvage'
>which might be available at their web site(s).
>I don't have it and have never used it. But it is purported
>to attempt to salvage damaged Advfs filesystems.
>
Digital support suggested this utility also, but it was not installed on our system (DU4.0b) and Digital did not locate a copy before management here decided to terminate the effort.
Nick Batchelor confirmed my experience that information on the structure of Advfs is not generally available.
I briefly (for several hours) attempted a brute force approach, using the vfile utility. While in principle this would have worked, I do not know the range of the vfile parameters (page and cell numbers) and could not predict the time required to complete an exhaustive search, thus the attempt was abandoned.
Overall, a very frustrating experience. Perhaps Compaq will be more forthcoming?
Thanks all,
Ian Goodacre
!
!
Received on Mon Jun 15 1998 - 15:37:53 NZST