{"id":25,"date":"2012-03-06T13:32:37","date_gmt":"2012-03-06T09:32:37","guid":{"rendered":"http:\/\/pavlenko.net\/antony\/?p=25"},"modified":"2020-05-07T00:53:59","modified_gmt":"2020-05-06T20:53:59","slug":"vxfs-debugging","status":"publish","type":"post","link":"http:\/\/pavlenko.net\/antony\/2012\/03\/06\/vxfs-debugging\/","title":{"rendered":"vxfs debugging"},"content":{"rendered":"

Some days ago I have a good weekend, trying to restore vxfs after disaster. And I can say it is rather easy.
\nSo,<\/p>\n

 fsdb -F vxfs \/dev\/dsk\/c5t4849544143484920443630303136303330303033d0s6 <\/pre>\n
Superblock usually have address 8192\u0431 so we can read it :<\/p>\n
\r\n> 8192B.p S\r\nsuper-block at 00000008.0000\r\nmagic a501fcf5 version 6\r\nctime 1162462873 656465 (Thu Nov 2 13:21:13 2006 MSD)\r\nlog_version 11 logstart 0 logend 0\r\nbsize 1024 size 10176000 dsize 10176000 ninode 0 nau 0\r\ndefiextsize 0 oilbsize 0 immedlen 96 ndaddr 10\r\naufirst 0 emap 0 imap 0 iextop 0 istart 0\r\nbstart 0 femap 0 fimap 0 fiextop 0 fistart 0 fbstart 0\r\nnindir 2048 aulen 32768 auimlen 0 auemlen 8\r\nauilen 0 aupad 0 aublocks 32768 maxtier 15\r\ninopb 4 inopau 0 ndiripau 0 iaddrlen 8 bshift 10\r\ninoshift 2 bmask fffffc00 boffmask 3ff checksum ea56180b\r\nfree 10156420 ifree 0\r\nefree 0 0 1 2 1 1 1 2 0 2 1 0 1 1 1 1 2 2 1 2 2 1 1 0 0 0 0 0 0 0 0 0\r\nflags 0 mod 0 clean 5a\r\ntime 1162468635 951515 (Thu Nov 2 14:57:15 2006 MSD)\r\noltext[0] 32 oltext[1] 19458 oltsize 1\r\niauimlen 1 iausize 4 dinosize 256\r\nchecksum2 0 checksum3 0\r\nfsetquotaction 0\r\nfsetquotahardlimit 0 fsetquotasoftlimit 0\r\nlog_gen 2\r\nfs_metadevid 0 fs_metablkno 0 fs_metatype 0\r\nfs_bsoffset 0 fs_bsdevid 0 fs_bssize 0\r\n<\/pre>\n
Alternative superblock can be fount in inode 33 in 1 fileset. Haw to
\nlook at it read this paper \ud83d\ude42<\/p>\n
VXFS use filesets. Each fileset have it’s own inode list and data blocks and even can be mounted separately. So checkpoints implemented for example.<\/p>\n
\r\n> listfset\r\nfset index fset name\r\n 1 ATTRIBUTE\r\n 999 UNNAMED\r\n<\/pre>\n
listfset command shows all fsets. I have no checkpoints, so I have only 2. You can see information about fileset using command fset .<\/p>\n
\r\n> 999fset\r\nfset header structure at 0x0000000a.0000\r\nfsh_fsindex 999 fsh_fsetname \"UNNAMED\"\r\nfsh_version 5 fsh_checksum 0xcffdaf6b\r\nfsh_time 1162465202 992960 (Thu Nov 2 14:00:02 2006 MSD)\r\nfsh_ninode 32 fsh_nau 1 fsh_old_ilesize 0 fsh_eopdata 0\r\nfsh_fsextop 0x0 fsh_dflags 0x311 fsh_quota 0 fsh_maxinode 4294967295\r\nfsh_ilistino[65 97] fsh_iauino 64 fsh_lctino 0\r\nfsh_uquotino 69 fsh_gquotino 70\r\nfsh_attr_ninode 256 fsh_attr_nau 1 fsh_attr_eopdata 0\r\nfsh_attr_ilistino[67 99] fsh_attr_iauino 66 fsh_attr_lctino 68\r\nfsh_features 0x1\r\nfsh_previx 0 fsh_nextix 0\r\nfsh_ctime 1162462873 656465 (Thu Nov 2 13:21:13 2006 MSD)\r\nfsh_mtime 1162462909 466010 (Thu Nov 2 13:21:49 2006 MSD)\r\n<\/pre>\n
Here we can see a lot of useful information and meaning of variables can be easily understandable. Detailed info you can read at man inode_vxfs and fs_vxfs. Typically inode is 256 bytes but also can be 512 (version >5). Fileset “Attribute” is a structural fileset, it contains list of inodes, This fileset used internally by filesystem and it always has index 1. I have found only 2 inodes in this fileset, which are referencing inode list file. They are 65 and 97 (fsh_ilistino) Type IFILT confirms that this inode is inode list file. I think that fixextsize\/fsindex field told to us to which fileset this inode list is delivered. We can look at this inode :<\/p>\n
\r\n> 1fset.65i\r\ninode structure at 0x00000018.0100\r\ntype IFILT mode 4000000777 nlink 1 uid 0 gid 0 size 8192\r\natime 1162462873 656465 (Thu Nov 2 13:21:13 2006 MSD)\r\nmtime 1162462873 656465 (Thu Nov 2 13:21:13 2006 MSD)\r\nctime 1162462873 656465 (Thu Nov 2 13:21:13 2006 MSD)\r\naflags 0 orgtype 1 eopflags 0 eopdata 0\r\nfixextsize\/fsindex 999 rdev\/reserve\/dotdot\/matchino 97\r\nblocks 8 gen 15307 version 0 0 iattrino 0\r\ndotdot 0 inattrino 0\r\nde: 16680 0 0 0 0 0 0 0 0 0\r\ndes: 8 0 0 0 0 0 0 0 0 0\r\nie: 0 0\r\nies: 0\r\n<\/pre>\n
de field list direct extends and des – their sizes in file system blocks. So<\/p>\n
\r\n> 16680b.p6I - will print info for first 6 inodes.\r\n.....\r\ntype IFDIR mode 40755 nlink 5 uid 0 gid 1 size 96\r\natime 1162462924 488018 (Thu Nov 2 13:22:04 2006 MSD)\r\nmtime 1162462955 527947 (Thu Nov 2 13:22:35 2006 MSD)\r\nctime 1162462955 527947 (Thu Nov 2 13:22:35 2006 MSD)\r\naflags 0 orgtype 2 eopflags 0 eopdata 0\r\nfixextsize\/fsindex 0 rdev\/reserve\/dotdot\/matchino 2\r\nblocks 0 gen 4682 version 0 6 iattrino 0\r\ndotdot 2 inattrino 0\r\ninode structure at 0x00004129.0100\r\ntype IFDIR mode 40755 nlink 2 uid 0 gid 1 size 96\r\natime 1162462925 824823 (Thu Nov 2 13:22:05 2006 MSD)\r\nmtime 1162462925 824823 (Thu Nov 2 13:22:05 2006 MSD)\r\nctime 1162462925 824823 (Thu Nov 2 13:22:05 2006 MSD)\r\naflags 0 orgtype 2 eopflags 0 eopdata 0\r\nfixextsize\/fsindex 0 rdev\/reserve\/dotdot\/matchino 2\r\nblocks 0 gen 21988 version 0 2 iattrino 0\r\ndotdot 2 inattrino 0\r\n<\/pre>\n
First 2 inodes are reserved, and not used. 2 inode is root directory of file system and 3 – lost+found dir. Also you can read inode information from fileset directly :<\/p>\n
\r\n> 999fset.13i\r\ninode structure at 0x0000412b.0100\r\ntype IFREG mode 100644 nlink 1 uid 0 gid 1 size 38\r\natime 1162462955 528044 (Thu Nov 2 13:22:35 2006 MSD)\r\nmtime 1162468630 420948 (Thu Nov 2 14:57:10 2006 MSD)\r\nctime 1162468630 420948 (Thu Nov 2 14:57:10 2006 MSD)\r\naflags 0 orgtype 1 eopflags 0 eopdata 0\r\nfixextsize\/fsindex 0 rdev\/reserve\/dotdot\/matchino 0\r\nblocks 1 gen 17493 version 0 10 iattrino 0\r\ndotdot 4 inattrino 0\r\nde: 16715 0 0 0 0 0 0 0 0 0\r\ndes: 1 0 0 0 0 0 0 0 0 0\r\nie: 0 0\r\nies: 0\r\n<\/pre>\n
As block size is (bsezie in superblock) 1024, we can read this file, be reading 1 block from 16715 address.<\/p>\n
> 16715b.p1024c <\/pre>\n
and we see our file. c means print in chars but you can output ix hex for example, just change c to x. So you can read all information about file system and where files directly situated.<\/p>\n
After this basic info you can play with vxfs yourself \ud83d\ude42
\ngood luck<\/p>\n","protected":false},"excerpt":{"rendered":"
Some days ago I have a good weekend, trying to restore vxfs after disaster. And I can say it is rather easy. So, fsdb -F vxfs \/dev\/dsk\/c5t4849544143484920443630303136303330303033d0s6 Superblock usually have address 8192\u0431 so we can read it : > 8192B.p S super-block at 00000008.0000 magic a501fcf5 version 6 ctime 1162462873 656465 (Thu Nov 2 13:21:13 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"http:\/\/pavlenko.net\/antony\/wp-json\/wp\/v2\/posts\/25"}],"collection":[{"href":"http:\/\/pavlenko.net\/antony\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/pavlenko.net\/antony\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/pavlenko.net\/antony\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/pavlenko.net\/antony\/wp-json\/wp\/v2\/comments?post=25"}],"version-history":[{"count":3,"href":"http:\/\/pavlenko.net\/antony\/wp-json\/wp\/v2\/posts\/25\/revisions"}],"predecessor-version":[{"id":32,"href":"http:\/\/pavlenko.net\/antony\/wp-json\/wp\/v2\/posts\/25\/revisions\/32"}],"wp:attachment":[{"href":"http:\/\/pavlenko.net\/antony\/wp-json\/wp\/v2\/media?parent=25"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/pavlenko.net\/antony\/wp-json\/wp\/v2\/categories?post=25"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/pavlenko.net\/antony\/wp-json\/wp\/v2\/tags?post=25"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}