Backups

image backups

Image backups are convenient on machines such as:

• Windows
• embedded hosts
• Linux

The advantages are its a verbatim copy of the machine media, but the disadvantages are it is slow and archives can take up more room, unless compressed (which is why I have used compression such as lz4). Follow the backup instructions in Backup and Restore for LVM systems that use Volume Groups and Logical Volumes.

It is a simple matter to live boot the host with a USB device, or in the case of removable media, plugin that media to another host to perform the backups.

It is a simple matter to copy the media verbatim, not worrying about the partition layout. However, you can also use fdisk -L to obtain partition information and backup individual partitions, which is usually slightly faster - but more finicky. If you have plenty of archive storage and great numbers of machine it is less brain power to backup the whole media. Don;t forget some hosts put a swap partition on the media and it is a waste to back that up unless you want to restore resumable machine state. I usually convert my hosts to swapfile, or in many of the raspberry pi SBC I turn swap off.

lz4

Here are the basic disk imaging instructions usinf lz4 compression

• take not of the disk layout and devices using lsblk

lsblk

• Use forensice dc3dd

sudo dc3dd if=/home/volumes/repos.v | lz4 > /mnt/sc1/backups/server.arising.com.a/repos.20191127.lz4

• (or) you can use regular dd if you do not want to install dc3dd

dd if=/dev/sdx bs=10M status=progress | lz4 > sdx.img.lz4

• restore

lz4 -d sdx.lz4 | pv [-s <nG>] | dd bs=10M of=/dev/sdx oflag=sync # take care to chose correct sdx as dd overwrites!
lz4 -d sdx.lz4 | dd bs=10M of=/dev/sdx status=progress oflag=sync # take care to chose correct sdx as dd overwrites!

Don't forget the bs=<buffer> size if you use dd else you will be waiting a while for it to read and write to the target volume, dc3dd is able to default to a more reasonable buffer size if you use dc3dd instead.

xz

xz compression results in smaller files than lz4 files, but compression is much slower, though decompression is not so bad.

• backup and compress

dd if=/dev/sdx bs=10M status=progress | xz -c9 > sdx.img.xz 

• decompress and restore

xz -dk sdx.img.xz | dd bs=10M status=progress oflag=sync of=/dev/sdx   # take care to chose correct sdx as dd overwrites!

source backups

Source backups are an alternative means of copying Linux, bearing in mind that things will be changing while you do this backup. SO critical things like database journals might be in a historic state. You can always turn such services off while the source backup is performed.

• with tar on a live system

tar --exclude var/swap --exclude var/log --exclude mnt -c  bin boot etc home initrd.img lib lib32 lib64 libx32 opt root sbin srv usr var vmlinuz | xz -z > /mnt/some-backup-file.tar.xz

• or you can use ssh to remote copy to another system (which is left as a research exercise. I know how it is done and I use it for backing up remote systems :-) )

There are also other recommended what of doing a live copy and can be documented later.

I live backup all my remote raspberry pi's across the internet using ssh and a privileged backup program using tar and xz over a tunnel to a file on my backup host. A source backup is do-able on a live system without shutting down remote services. Linux is pretty resiliant.

useful stuff

iostat 60
locate (updatedb)

• Debian and Kali package names

apt install dc3dd lz4 sysstat mlocate rsync sysstats