本文共 9308 字，大约阅读时间需要 31 分钟。
## 1,文件不可改 && 不可删# append only (a), immutable (i), no atime updates (A)[root@cdh-node1 vagrant]# chattr +i /etc/passwd /etc/shadow[root@cdh-node1 vagrant]# lsattr /etc/shadow /etc/passwd----i--------e- /etc/shadow----i--------e- /etc/passwd[root@cdh-node1 vagrant]# useradd test1useradd: cannot open /etc/passwd[root@cdh-node1 vagrant]# echo 123 |passwd root --stdin Changing password for user root.passwd: Authentication token manipulation error[root@cdh-node1 vagrant]# rm -f /etc/passwd /etc/shadowrm: cannot remove `/etc/passwd': Operation not permittedrm: cannot remove `/etc/shadow': Operation not permitted## 2,目录不可改 && 不可删[root@cdh-node1 vagrant]# chattr -R +i /etc/ssh/ /root/.ssh/[root@cdh-node1 vagrant]# ssh-keygen -t rsa -P "" -f ~/.ssh/id_rsaGenerating public/private rsa key pair./root/.ssh/id_rsa already exists.Overwrite (y/n)? yopen /root/.ssh/id_rsa failed: Permission denied.Saving the key failed: /root/.ssh/id_rsa.[root@cdh-node1 vagrant]# sed -i 2d /etc/ssh/sshd_config sed: couldn't open temporary file /etc/ssh/sedsPF0hP: Permission denied
工具简介：
# 1,从elel仓库安装yum -y install epel-releaseyum -y install extundelete# 2,测试恢复删除## 环境准备[root@cdh-node1 data2]# df -hTFilesystem Type Size Used Avail Use% Mounted on/dev/sda1 ext4 40G 29G 9.1G 76% /tmpfs tmpfs 2.8G 8.0K 2.8G 1% /dev/shmcm_processes tmpfs 2.9G 6.7M 2.9G 1% /opt/cm-5.12.2/run/cloudera-scm-agent/process/dev/sdb1 ext4 988M 1.3M 935M 1% /data2[root@cdh-node1 data2]# ls /data2 -R/data2:9.txt d1 d2 seq.txt/data2/d1:a.txt/data2/d2:a.txt[root@cdh-node1 data2]# rm -rf /data2/*[root@cdh-node1 data2]# ls /data2/## a,卸载该磁盘设备[root@cdh-node1 data2]# cd[root@cdh-node1 ~]# sync; umount /data2/[root@cdh-node1 ~]# df -hTFilesystem Type Size Used Avail Use% Mounted on/dev/sda1 ext4 40G 29G 9.1G 76% /tmpfs tmpfs 2.8G 8.0K 2.8G 1% /dev/shmcm_processes tmpfs 2.9G 6.7M 2.9G 1% /opt/cm-5.12.2/run/cloudera-scm-agent/process### b1,恢复单个被删的文件(可能失败)[root@cdh-node1 ~]# extundelete /dev/sdb1 --restore-file 9.txtNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 9 groups loaded.Loading journal descriptors ... 50 descriptors loaded.Unable to restore inode 21 (9.txt): No undeleted copies found in the journal.Unable to restore file 9.txtextundelete: Operation not permitted while restoring file.extundelete: Operation not permitted when trying to examine filesystem[root@cdh-node1 ~]# lsRECOVERED_FILES[root@cdh-node1 ~]# ls RECOVERED_FILES/[root@cdh-node1 ~]# extundelete /dev/sdb1 --restore-file seq.txtNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 9 groups loaded.Loading journal descriptors ... 50 descriptors loaded.Successfully restored file seq.txt[root@cdh-node1 ~]# ls RECOVERED_FILES/d1 seq.txt[root@cdh-node1 ~]# ls RECOVERED_FILES/seq.txt RECOVERED_FILES/seq.txt[root@cdh-node1 ~]# cat RECOVERED_FILES/seq.txtseq### b2,恢复某个被删的目录[root@cdh-node1 ~]# extundelete /dev/sdb1 --restore-directory d1NOTICE: Extended attributes are not restored.Loading filesystem metadata ... 9 groups loaded.Loading journal descriptors ... 50 descriptors loaded.Searching for recoverable inodes in directory d1 ... 5 recoverable inodes found.Looking through the directory structure for deleted files ... 4 recoverable inodes still lost.[root@cdh-node1 ~]# ls RECOVERED_FILES/d1[root@cdh-node1 ~]# ls RECOVERED_FILES/d1/a.txt[root@cdh-node1 ~]# ls RECOVERED_FILES/d1/a.txt RECOVERED_FILES/d1/a.txt[root@cdh-node1 ~]# cat RECOVERED_FILES/d1/a.txtd1.txt### b3,恢复所有删除的数据[root@cdh-node1 ~]# extundelete /dev/sdb1 --restore-allNOTICE: Extended attributes are not restored.Loading filesystem metadata ... 9 groups loaded.Loading journal descriptors ... 50 descriptors loaded.Searching for recoverable inodes in directory / ... 5 recoverable inodes found.Looking through the directory structure for deleted files ... 0 recoverable inodes still lost.[root@cdh-node1 ~]# ls RECOVERED_FILES/d1 d2 seq.txt seq.txt.v1[root@cdh-node1 ~]# ls RECOVERED_FILES/d2a.txt[root@cdh-node1 ~]# ls RECOVERED_FILES/d2/a.txt RECOVERED_FILES/d2/a.txt[root@cdh-node1 ~]# cat RECOVERED_FILES/d2/a.txtd2.txt
yum -y install xfsdump #base仓库中有[root@iris2 /]# du -hs /data2/2.7G /data2/[root@iris2 /]# awk '{print FILENAME,NF,$0}' *.txta2.txt 1 1234a.txt 1 123# 1,备份xfs文件目录(第一次：全量备份)[root@iris2 /]# xfsdump -f dump_data2_full /data2 -L fulldump -M sdb2 xfsdump: using file dump (drive_simple) strategyxfsdump: version 3.1.7 (dump format 3.0) - type ^C for status and controlxfsdump: level 0 dump of iris2:/data2xfsdump: dump date: Wed Apr 29 10:50:02 2020xfsdump: session id: b2038b69-0728-4f3c-9d5c-d1d280e6a16axfsdump: session label: "fulldump"xfsdump: ino map phase 1: constructing initial dump listxfsdump: ino map phase 2: skipping (no pruning necessary)xfsdump: ino map phase 3: skipping (only one dump stream)xfsdump: ino map construction completexfsdump: estimated dump size: 2855133824 bytesxfsdump: creating dump session media file 0 (media 0, file 0)xfsdump: dumping ino mapxfsdump: dumping directoriesxfsdump: dumping non-directory filesxfsdump: ending media filexfsdump: media file size 2850312592 bytesxfsdump: dump size (non-dir files) : 2847706232 bytesxfsdump: dump complete: 5 seconds elapsedxfsdump: Dump Summary:xfsdump: stream 0 /dump_data2_full OK (success)xfsdump: Dump Status: SUCCESS# 2,备份xfs文件目录(第二次：增量备份,level=1)[root@iris2 /]# cp a.txt /data2[root@iris2 /]# xfsdump -f dump_data2_l1 /data2 -L l1_dump -M sdb2 -l 1xfsdump: using file dump (drive_simple) strategyxfsdump: version 3.1.7 (dump format 3.0) - type ^C for status and controlxfsdump: level 1 incremental dump of iris2:/data2 based on level 0 dump begun Wed Apr 29 10:50:02 2020xfsdump: dump date: Wed Apr 29 10:50:51 2020xfsdump: session id: 9762554a-1ae4-4fba-88f3-6b4d2a9eb980xfsdump: session label: "l1_dump"xfsdump: ino map phase 1: constructing initial dump listxfsdump: ino map phase 2: pruning unneeded subtreesxfsdump: ino map phase 3: skipping (only one dump stream)xfsdump: ino map construction completexfsdump: estimated dump size: 25216 bytesxfsdump: creating dump session media file 0 (media 0, file 0)xfsdump: dumping ino mapxfsdump: dumping directoriesxfsdump: dumping non-directory filesxfsdump: ending media filexfsdump: media file size 22232 bytesxfsdump: dump size (non-dir files) : 544 bytesxfsdump: dump complete: 0 seconds elapsedxfsdump: Dump Summary:xfsdump: stream 0 /dump_data2_l1 OK (success)xfsdump: Dump Status: SUCCESS# 3,备份xfs文件目录(第三次：增量备份,level=2)[root@iris2 /]# cp a2.txt /data2[root@iris2 /]# xfsdump -f dump_data2_l2 /data2 -L l2_dump -M sdb2 -l 2xfsdump: using file dump (drive_simple) strategyxfsdump: version 3.1.7 (dump format 3.0) - type ^C for status and controlxfsdump: level 2 incremental dump of iris2:/data2 based on level 1 dump begun Wed Apr 29 10:50:51 2020xfsdump: dump date: Wed Apr 29 10:51:17 2020xfsdump: session id: bfed98bc-fc24-4b57-b5d2-c2d7f55fda55xfsdump: session label: "l2_dump"xfsdump: ino map phase 1: constructing initial dump listxfsdump: ino map phase 2: pruning unneeded subtreesxfsdump: ino map phase 3: skipping (only one dump stream)xfsdump: ino map construction completexfsdump: estimated dump size: 25216 bytesxfsdump: creating dump session media file 0 (media 0, file 0)xfsdump: dumping ino mapxfsdump: dumping directoriesxfsdump: dumping non-directory filesxfsdump: ending media filexfsdump: media file size 22264 bytesxfsdump: dump size (non-dir files) : 544 bytesxfsdump: dump complete: 0 seconds elapsedxfsdump: Dump Summary:xfsdump: stream 0 /dump_data2_l2 OK (success)xfsdump: Dump Status: SUCCESS# 4,查看备份文件的大小[root@iris2 /]# ll -h dump_data2_*-rw-r--r--. 1 root root 2.7G Apr 29 10:50 dump_data2_full-rw-r--r--. 1 root root 22K Apr 29 10:50 dump_data2_l1-rw-r--r--. 1 root root 22K Apr 29 10:51 dump_data2_l2# 5，删除原来的数据，测试恢复[root@iris2 /]# rm -rf /opt/*[root@iris2 /]# ls /opt/*ls: cannot access /opt/*: No such file or directory[root@iris2 /]# ls /opt/[root@iris2 /]# [root@iris2 /]# xfsrestore -f dump_data2_full /data2/xfsrestore: using file dump (drive_simple) strategyxfsrestore: version 3.1.7 (dump format 3.0) - type ^C for status and controlxfsrestore: searching media for dumpxfsrestore: examining media file 0xfsrestore: dump description: xfsrestore: hostname: iris2xfsrestore: mount point: /data2xfsrestore: volume: /dev/sdb2xfsrestore: session time: Wed Apr 29 10:50:02 2020xfsrestore: level: 0xfsrestore: session label: "fulldump"xfsrestore: media label: "sdb2"xfsrestore: file system id: 535a1e95-5f9a-4208-b675-969996840f45xfsrestore: session id: b2038b69-0728-4f3c-9d5c-d1d280e6a16axfsrestore: media id: aaadc3f5-7e8b-4ecf-8299-20f812579be7xfsrestore: using online session inventoryxfsrestore: searching media for directory dumpxfsrestore: reading directoriesxfsrestore: 299 directories and 3841 entries processedxfsrestore: directory post-processingxfsrestore: restoring non-directory fileslxfsrestore: restore complete: 4 seconds elapsedxfsrestore: Restore Summary:xfsrestore: stream 0 /dump_data2_full OK (success)xfsrestore: Restore Status: SUCCESS[root@iris2 /]# ls /data2a.txt a2.txt iris[root@iris2 /]# cat /data2/a2.txt 1234 转载地址：http://hcdef.baihongyu.com/