Backup full system, no offline

BakaO · n00b Joined: 27 Sep 2003 Posts: 74

Hello,

I want to use security tool (nessus) on my production server.

As I don't want to break my server, I would like to test nessus in a fake server in a virtual machine.

So I would like to know how I can create this VM without putting offline my server.

Thanks for all.

TJNII · l33t Joined: 09 Nov 2003 Posts: 637 Location: for(;;);

I frequently just tar up the filesystem while it is running. It is bad practice, but it often works.

I cloned my production box off to a second server just this week for very similar reasons. I just tarred up root, untarred it on the second box, populated /dev with critical nodes, tweaked the settings in /etc which need tweaking for a second box, installed the bootloader, and I was off.

I want to reiterate that this is bad practice, though. I'm sure I'm going to get jumped on for suggesting it, but it will probably work. It isn't any worse than a ungraceful shutdown.
_________________
Maintaining documentation on upgrades is apparently not within the power of Gentoo
Beware when you emerge -u world!

Hu · Moderator Joined: 06 Mar 2007 Posts: 21635

Since TJNII already disclaimed his method as bad practice, I will not jump on him for that. However, as a technical point, if you pursue this route, or any of its variations based on rsync, cp, etc., take care that you do not copy pseudo-filesystems like /dev, but do copy the mount points of those filesystems. Also, be careful to catch and send along any files which are normally shadowed by mounted filesystems. Some systems need a /dev on / that contains certain device nodes, and copying while live would normally miss those due to the udev-managed tmpfs shadowing them.

cach0rr0 · Posted: Mon Mar 14, 2011 2:05 am Post subject:

Hu · Moderator Joined: 06 Mar 2007 Posts: 21635

It is a bit sloppy, but seems passable for most cases. As I hinted at above, I would use bind mounts so that the contents of directories that are shadowed during normal operation can still be included. If you need to split the archive, I would split it as it is generated, rather than writing a full tar file and then performing a separate split afterward. Excluding /usr/src will anger Portage when the files from sys-kernel/*-sources do not survive the transfer. I think FEATURES=splitdebug may also cause files to be written into /usr/src. The instructions assume use of an MBR style partition table, which may not be the case on modern drives.

chiefbag · Guru Joined: 01 Oct 2010 Posts: 542 Location: The Kingdom