Linux系統(tǒng)災(zāi)難恢復(fù)技術(shù)和方法
Linux 發(fā)行版本眾多,現(xiàn)如今也得到了越來越廣泛的應(yīng)用,同時(shí)也面臨著系統(tǒng)出現(xiàn)故障的潛在風(fēng)險(xiǎn),本文將以發(fā)行版本 RHEL6 為例詳細(xì)介紹幾種 Linux 災(zāi)難恢復(fù)技術(shù)和方法,以確保 Linux 系統(tǒng)的安全恢復(fù)。
在介紹 Linux 災(zāi)難恢復(fù)方法之前,我們先來了解下 MBR,其全稱為 Master Boot Record,即硬盤的主引導(dǎo)記錄。它由三個(gè)部分組成,主引導(dǎo)程序、硬盤分區(qū)表和硬盤有效標(biāo)志。在總共 512 字節(jié)的主引導(dǎo)扇區(qū)里主引導(dǎo)程序(Bootloader)占 446 個(gè)字節(jié),第二部分是硬盤分區(qū)表,占 64 個(gè)字節(jié),硬盤有多少分區(qū)以及每一分區(qū)的大小都記錄在其中。第三部分是硬盤有效標(biāo)志,占 2 個(gè)字節(jié)。具體如圖示:
圖 1. MBR
系統(tǒng)硬盤分區(qū)表破壞
生產(chǎn)環(huán)境中的 Linux 服務(wù)器可能會(huì)因?yàn)椴《净蛘咭馔鈹嚯姸鹩脖P分區(qū)表被破壞,通?;謴?fù)硬盤分區(qū)表需要之前我們先備份其分區(qū)表的信息,一般我們使用 USB 外接設(shè)備來備份主機(jī)硬盤的分區(qū)表。
在主機(jī)上掛載 USB 設(shè)備后我們查看系統(tǒng)當(dāng)前磁盤設(shè)備:
- [root@FCoE ~]# fdisk -l
- Disk /dev/sda: 43.0 GB, 42991616000 bytes
- 255 heads, 63 sectors/track, 5226 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0x00032735
- Device Boot Start End Blocks Id System
- /dev/sda1 * 1 17 131072 83 Linux
- Partition 1 does not end on cylinder boundary.
- /dev/sda2 17 147 1048576 82 Linux swap / Solaris
- Partition 2 does not end on cylinder boundary.
- /dev/sda3 147 5227 40803328 83 Linux
- Disk /dev/sdb: 2147 MB, 2147483648 bytes
- 255 heads, 63 sectors/track, 261 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0x00000000
- Disk /dev/sdb doesn't contain a valid partition table
現(xiàn)在我們?cè)?sdb 這個(gè)設(shè)備上創(chuàng)建一個(gè)新的分區(qū):
- [root@FCoE ~]# fdisk /dev/sdb
- Device contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabel
- Building a new DOS disklabel with disk identifier 0xcdd48395.
- Changes will remain in memory only, until you decide to write them.
- After that, of course, the previous content won't be recoverable.
- Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)
- WARNING: DOS-compatible mode is deprecated. It's strongly recommended to
- switch off the mode (command 'c') and change display units to
- sectors (command 'u').
- Command (m for help): n
- Command action
- e extended
- p primary partition (1-4)
- p
- Partition number (1-4): 1
- First cylinder (1-261, default 1):
- Using default value 1
- Last cylinder, +cylinders or +size{K,M,G} (1-261, default 261):
- Using default value 261
- Command (m for help): p
- Disk /dev/sdb: 2147 MB, 2147483648 bytes
- 255 heads, 63 sectors/track, 261 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0xcdd48395
- Device Boot Start End Blocks Id System
- /dev/sdb1 1 261 2096451 83 Linux
- Command (m for help): w
- The partition table has been altered!
- Calling ioctl() to re-read partition table.
- Syncing disks.
在新分區(qū) sdb1 上創(chuàng)建文件系統(tǒng):
- [root@FCoE ~]# mkfs.ext3 /dev/sdb1
- mke2fs 1.41.12 (17-May-2010)
- Filesystem label=
- OS type: Linux
- Block size=4096 (log=2)
- Fragment size=4096 (log=2)
- Stride=0 blocks, Stripe width=0 blocks
- 131072 inodes, 524112 blocks
- 26205 blocks (5.00%) reserved for the super user
- First data block=0
- Maximum filesystem blocks=536870912
- 16 block groups
- 32768 blocks per group, 32768 fragments per group
- 8192 inodes per group
- Superblock backups stored on blocks:
- 32768, 98304, 163840, 229376, 294912
- Writing inode tables: done
- Creating journal (8192 blocks): done
- Writing superblocks and filesystem accounting information: done
- This filesystem will be automatically checked every 24 mounts or
- 180 days, whichever comes first. Use tune2fs -c or -i to override.
掛載新的文件系統(tǒng):
- [root@FCoE ~]# mount /dev/sdb1 /mnt/
通常我們通過備份硬盤的 MBR 來備份硬盤分區(qū)表:
- [root@FCoE ~]# dd if=/dev/sda of=/mnt/sda.mbr bs=512 count=1
- 1+0 records in
- 1+0 records out
- 512 bytes (512 B) copied, 0.000777948 s, 658 kB/s
現(xiàn)在我們來寫零硬盤分區(qū)表來實(shí)現(xiàn)類似分區(qū)表被破壞的結(jié)果:
- [root@FCoE ~]# dd if=/dev/zero of=/dev/sda bs=1 count=64 skip=446 seek=446
- 64+0 records in
- 64+0 records out
- 64 bytes (64 B) copied, 0.00160668 s, 39.8 kB/s
查詢硬盤 sda 上的分區(qū)信息,發(fā)現(xiàn)其已不包含任何分區(qū):
- [root@FCoE ~]# fdisk -l
- Disk /dev/sda: 43.0 GB, 42991616000 bytes
- 255 heads, 63 sectors/track, 5226 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0x00032735
- Device Boot Start End Blocks Id System
- Disk /dev/sdb: 2147 MB, 2147483648 bytes
- 255 heads, 63 sectors/track, 261 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0xcdd48395
- Device Boot Start End Blocks Id System
- /dev/sdb1 1 261 2096451 83 Linux
當(dāng)主機(jī)硬盤分區(qū)表丟失了之后,再次啟動(dòng)后 GRUB 會(huì)因找不到配置文件而進(jìn)入命令行模式:
圖 2. 分區(qū)表丟失
接下來我們掛載 RHEL6 的安裝盤,同時(shí)也接入我們之前備份的 USB 設(shè)備,然后重啟主機(jī),選擇 CD-ROM 為第一引導(dǎo)設(shè)備,啟動(dòng)后選擇“Rescue installed system”。
圖 3. 選擇援救
按照提示,最終我們選擇一個(gè) shell。
圖 4. 選擇 shell
我們查詢系統(tǒng)磁盤信息,發(fā)現(xiàn)硬盤設(shè)備 sda 沒有包含任何分區(qū)。
- bash-4.1# fdik – l
- Disk /dev/sda: 43.0 GB, 42991616000 bytes
- 255 heads, 63 sectors/track, 5226 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0x00032735
- Device Boot Start End Blocks Id System
- Disk /dev/sdb: 2147 MB, 2147483648 bytes
- 255 heads, 63 sectors/track, 261 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0xcdd48395
- Device Boot Start End Blocks Id System
- /dev/sdb1 1 261 2096451 83 Linux
我們來恢復(fù)它的硬盤分區(qū)表,創(chuàng)建一個(gè)目錄并且掛載之前備份的 USB 設(shè)備,我們看到它的設(shè)備名是 /dev/sdb。
- bash-4.1# mount /dev/sdb1 /usb
- bash-4.1# ls /usb
- lost+found sda.mbr
通過原來備份的 sda.mbr 文件來恢復(fù)硬盤設(shè)備 sda 的硬盤分區(qū)表:
- bash-4.1# dd if=/usb/sda.mbr of=/dev/sda bs=1 count=64 skip=446 seek=446
- 64+0 records in
- 64+0 records out
- 64 bytes (64 B) copied, 0.038358 s, 4.6 kB/s
再次查詢系統(tǒng)磁盤信息:
- bash-4.1# fdisk -l
- Disk /dev/sda: 43.0 GB, 42991616000 bytes
- 255 heads, 63 sectors/track, 5226 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0x00032735
- Device Boot Start End Blocks Id System
- /dev/sda1 * 1 17 131072 83 Linux
- Partition 1 does not end on cylinder boundary.
- /dev/sda2 17 147 1048576 82 Linux swap / Solaris
- Partition 2 does not end on cylinder boundary.
- /dev/sda3 147 5227 40803328 83 Linux
- Disk /dev/sdb: 2147 MB, 2147483648 bytes
- 255 heads, 63 sectors/track, 261 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0xcdd48395
- Device Boot Start End Blocks Id System
- /dev/sdb1 1 261 2096451 83 Linux
硬盤設(shè)備 sda 的分區(qū)表已經(jīng)恢復(fù),重啟后系統(tǒng)便可正常引導(dǎo)。#p#
系統(tǒng) GRUB 損壞
類似得我們可以來寫零 Bootloader 來實(shí)現(xiàn) GRUB 被破壞的結(jié)果:
- [root@FCoE grub]# dd if=/dev/zero of=/dev/sda bs=446 count=1
- 1+0 records in
- 1+0 records out
- 446 bytes (446 B) copied, 0.0017583 s, 254 kB/s
重啟后系統(tǒng)會(huì)因找不到 GRUB 而卡在“Booting from Hard Disk …”
掛載系統(tǒng)安裝光盤然后選擇進(jìn)入 Rescue 模式,然后恢復(fù) GRUB:
- bash-4.1# chroot /mnt/sysimage
- sh-4.1# grub
- grub > root hd(0,0)
- grub > setup (hd0)
- grub > quit
圖 5. 恢復(fù) GRUB
重啟主機(jī)后,系統(tǒng)可正常引導(dǎo)。
系統(tǒng)內(nèi)核文件丟失
系統(tǒng)丟失內(nèi)核 kernel 文件,再次啟動(dòng)后會(huì)提示找不到文件。
圖 6. 內(nèi)核丟失
掛載系統(tǒng)安裝盤進(jìn)入援救模式,檢查 /boot 目錄下發(fā)現(xiàn)沒有 kernel 文件。
- bash-4.1# chroot /mnt/sysimage
- bash-4.1# ls /boot
- ls
- config-2.6.32-71.el6.x86_64 lost+found
- efi symvers-2.6.32-71.el6.x86_64.gz
- grub System.map-2.6.32-71.el6.x86_64
- initramfs-2.6.32-71.el6.x86_64.img
從掛載的系統(tǒng)安裝盤強(qiáng)制重新安裝內(nèi)核:
- sh-4.1# mount – o loop /dev/sr0 /media
- sh-4.1# cd /media/Server/Packages
- sh-4.1# rpm -ivh --force kernel-2.6.32-71.el6.x86_64.rpm
- warning: kernel-2.6.32-71.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, \
- key ID fd431d51: NOKEY
- Preparing... ########################################### [100%]
- 1:kernel ########################################### [100%]
在 /boot 目錄下已經(jīng)生成新的 kernel 文件 vmlinuz-2.6.32-71.el6.x86_64
- sh-4.1## ls /boot
- config-2.6.32-71.el6.x86_64 lost+found
- efi symvers-2.6.32-71.el6.x86_64.gz
- grub System.map-2.6.32-71.el6.x86_64
- initramfs-2.6.32-71.el6.x86_64.img vmlinuz-2.6.32-71.el6.x86_64
重啟主機(jī)后,系統(tǒng)可正常引導(dǎo)。
系統(tǒng)鏡像文件丟失
系統(tǒng)丟失鏡像文件,主機(jī)啟動(dòng)后黑屏。
圖 7. 鏡像丟失
掛載系統(tǒng)安裝盤進(jìn)入援救模式 , 檢查 /boot 目錄下發(fā)現(xiàn)沒有鏡像文件。
- bash-4.1# chroot /mnt/sysimage
- sh-4.1# ls /boot
- config-2.6.32-71.el6.x86_64 symvers-2.6.32-71.el6.x86_64.gz
- efi System.map-2.6.32-71.el6.x86_64
- grub vmlinuz-2.6.32-71.el6.x86_64
- lost+found
重新生成鏡像文件 initramfs-2.6.32-71.el6.x86_64.img。
- sh-4.1# cd /boot
- sh-4.1# mkinit
- sh-4.1# ls
- config-2.6.32-71.el6.x86_64 lost+found
- efi symvers-2.6.32-71.el6.x86_64.gz
- grub System.map-2.6.32-71.el6.x86_64
- initramfs-2.6.32-71.el6.x86_64.img vmlinuz-2.6.32-71.el6.x86_64
重啟主機(jī)后 , 系統(tǒng)可正常引導(dǎo)。#p#
系統(tǒng) /boot 分區(qū)損壞
一般來說系統(tǒng) /boot 分區(qū)損壞,我們會(huì)先嘗試修復(fù)文件系統(tǒng)。如果文件系統(tǒng)損壞不能修復(fù),那么我們可以參照前述的方法來依次新建 /boot 分區(qū),重新安裝內(nèi)核和鏡像,然后安裝 GURB 再手工編輯引導(dǎo)菜單,以最終來恢復(fù)系統(tǒng)可正常引導(dǎo)。通常我們需要按照如下的步驟來恢復(fù)。
創(chuàng)建分區(qū)
碰到比較嚴(yán)重的情況就是 /boot 分區(qū)已經(jīng)完全損壞,啟動(dòng)時(shí)會(huì)提示找不到引導(dǎo)設(shè)備。
圖 8. 引導(dǎo)分區(qū)損壞
掛載安裝盤后進(jìn)入援救模式,查看分區(qū)情況,發(fā)現(xiàn)分區(qū) /dev/sda1 不存在。
- bash-4.1#
- Disk /dev/sda: 43.0 GB, 42991616000 bytes
- 255 heads, 63 sectors/track, 5226 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0x00000000
- Device Boot Start End Blocks Id System
- /dev/sda2 17 147 1048576 82 Linux swap / Solaris
- Partition 2 does not end on cylinder boundary.
- /dev/sda3 147 5227 40803328 83 Linux
- Disk /dev/sdb: 2147 MB, 2147483648 bytes
- 255 heads, 63 sectors/track, 261 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0xcdd48395
- Device Boot Start End Blocks Id System
- /dev/sdb1 1 261 2096451 83 Linux
新建一個(gè)分區(qū)并且設(shè)置它為啟動(dòng)分區(qū)。
- bash-4.1# fdisk /dev/sda
- WARNING: DOS-compatible mode is deprecated. It's strongly recommended to
- switch off the mode (command 'c') and change display units to
- sectors (command 'u').
- Command (m for help): n
- Command action
- e extended
- p primary partition (1-4)
- p
- Partition number (1-4): 1
- First cylinder (1-5226, default 1):
- Using default value 1
- Last cylinder, +cylinders or +size{K,M,G} (1-16, default 16):
- Using default value 16
- Command (m for help): a
- Partition number (1-4): 1
- Command (m for help): p
- Disk /dev/sda: 43.0 GB, 42991616000 bytes
- 255 heads, 63 sectors/track, 5226 cylinders
- Units = cylinders of 16065 * 512 = 8225280 bytes
- Sector size (logical/physical): 512 bytes / 512 bytes
- I/O size (minimum/optimal): 512 bytes / 512 bytes
- Disk identifier: 0x00000000
- Device Boot Start End Blocks Id System
- /dev/sda1 * 1 16 128488+ 83 Linux
- /dev/sda2 17 147 1048576 82 Linux swap / Solaris
- Partition 2 does not end on cylinder boundary.
- /dev/sda3 147 5227 40803328 83 Linux
- Command (m for help): w
- The partition table has been altered!
重啟主機(jī)以更新分區(qū)表,然后進(jìn)入援救模式,并在我們新創(chuàng)建的分區(qū)上創(chuàng)建文件系統(tǒng)。
- bash-4.1# mkfs.ext4 /dev/sda1
- Filesystem label=
- OS type: Linux
- Block size=1024 (log=0)
- Fragment size=1024 (log=0)
- Stride=0 blocks, Stripe width=0 blocks
- 32128 inodes, 128488 blocks
- 6424 blocks (5.00%) reserved for the super user
- First data block=1
- Maximum filesystem blocks=67371008
- 16 block groups
- 8192 blocks per group, 8192 fragments per group
- 2008 inodes per group
- Superblock backups stored on blocks:
- 8193, 24577, 40961, 57345, 73729
- Writing inode tables: done
- Creating journal (4096 blocks): done
- Writing superblocks and filesystem accounting information: done
- This filesystem will be automatically checked every 38 mounts or
- 180 days, whichever comes first. Use tune2fs -c or -i to override.
安裝內(nèi)核鏡像文件
通過前述的方法我們安裝內(nèi)核和鏡像文件。
- bash-4.1# chroot /mnt/sysimage
- sh-4.1# mount /dev/sda1 /boot
- sh-4.1# mount – o loop /dev/sr0 /media
- sh-4.1# cd /media/Server/Packages
- sh-4.1# rpm -ivh --force kernel-2.6.32-71.el6.x86_64.rpm
- warning: kernel-2.6.32-71.el6.x86_64.rpm: \
- Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
- Preparing... ########################################### [100%]
- 1:kernel ########################################### [100%]
安裝 GRUB
我們安裝 GRUB 到硬盤設(shè)備 sda 上。
- sh-4.1# grub-install /dev/sda
- Installation finished. No error reported.
- This is the contents of the device map /boot/grub/device.map.
- Check if this is correct or not. If any of the lines is incorrect,
- fix it and re-run the script `grub-install'.
- (fd0) /dev/fd0
- (hd0) /dev/sda
- (hd1) /dev/sdb
編輯引導(dǎo)菜單
由于我們創(chuàng)建了新的分區(qū),其對(duì)應(yīng)的 UUID 會(huì)發(fā)生變化,可以通過命令 blkid 來查詢分區(qū)的 UUID。
- bash-4.1# blkid
- /dev/loop0: TYPE="squashfs"
- /dev/sda2: UUID="7b1e0fac-ff06-492c-848d-497e2a38c54e" TYPE="swap"
- /dev/sda3: UUID="ef89764e-04ff-4f26-ae82-dcab267ecc66" TYPE="ext4"
- /dev/sdb1: UUID="2b824352-df2a-44c6-a547-838d46f526fa" SEC_TYPE="ext2" TYPE="ext3"
- /dev/loop1: LABEL="RHEL_6.0 x86_64 Disc 1" TYPE="iso9660"
- /dev/sda1: UUID="cec964af-1618-48ff-ac33-4ef71b9d3265" TYPE="ext4"
上述的 sda3 為根分區(qū),編輯 /boot/grub/grub.conf 文件更新其對(duì)應(yīng)的 UUID,其內(nèi)容如下。
- title Red Hat Enterprise Linux 6
- root (hd0,0)
- kernel /vmlinuz-2.6.32-71.el6.x86_64 \
- root=UUID=ef89764e-04ff-4f26-ae82-dcab267ecc66 rhgb quiet
- initrd /initramfs-2.6.32-71.el6.x86_64.img
更新 /etc/fstab
類似的我們也需要更新 /etc/fstab 里 /boot 分區(qū)對(duì)應(yīng)的新 UUID,其內(nèi)容如下。
- #
- # /etc/fstab
- # Created by anaconda on Sun Mar 18 04:35:07 2012
- #
- # Accessible filesystems, by reference, are maintained under '/dev/disk'
- # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
- #
- UUID=ef89764e-04ff-4f26-ae82-dcab267ecc66 / ext4 defaults 1 1
- UUID=cec964af-1618-48ff-ac33-4ef71b9d3265 /boot ext4 defaults 1 2
- UUID=7b1e0fac-ff06-492c-848d-497e2a38c54e swap swap defaults 0 0
- tmpfs /dev/shm tmpfs defaults 0 0
- devpts /dev/pts devpts gid=5,mode=620 0 0
- sysfs /sys sysfs defaults 0 0
- proc /proc proc defaults 0 0
現(xiàn)在我們的恢復(fù)步驟已經(jīng)完成,重啟主機(jī)后 GRUB 中可見我們配置的系統(tǒng)列表。
圖 9. GRUB 菜單
至此 /boot 分區(qū)已恢復(fù),系統(tǒng)可正常引導(dǎo)啟動(dòng)。
圖 10. 系統(tǒng)啟動(dòng)
總結(jié)
本文闡述了常見的 Linux 災(zāi)難恢復(fù)技術(shù)和方法,及其出現(xiàn)嚴(yán)重災(zāi)難時(shí)應(yīng)注意的恢復(fù)順序,以確保 Linux 系統(tǒng)在出現(xiàn)災(zāi)難時(shí)得以安全恢復(fù)。