Linux深入了解文件系统和日志分析

目录

一.inode & block

inode和block概述

block(块)

inode(索引节点)​编辑

inode的内容

inode包含文件的元信息

用stat命令可以查看某个文件的inode信息

Linux系统文件三个主要的时间属性

目录文件的结构

inode的号码

用户通过文件名打开文件时，系统内部的过程

查看inode号码的方法

inode的大小

inode也会消耗硬盘空间

格式化文件系统时确定inode的总数

使用df -i命令可以查看每个硬盘分区的inode总数和已经使用的数量

inode的特殊作用

由于inode号码与文件名分离，导致一些Unix/Linux系统具有以下的现象

​编辑 二.链接文件

三.文件恢复

EXT类型文件恢复

编译安装extundelete软件包

安装依赖包

配置、编译及安装

模拟删除并执行恢复操作

注意：extundelete工具目前只能恢复ext类型的文件

磁盘有空间，但是仍然无法写入新文件的可能原因如下所示：

​编辑

​编辑

​编辑

实验三

XFS类型文件恢复

（2）使用xfsdump 命令备份整个分区；

​编辑

​编辑

（3）模拟数据丢失并使用 xfsrestore 命令恢复文件；

四.日志文件

日志的功能

日志文件的分类

用户日志

程序日志

日志保存位置

主要日志文件介绍

内核及系统日志

日志消息的级别

日志记录的一般格式

---

一.inode & block

inode和block概述

• 文件数据包括元信息与实际数据
• 文件存储在硬盘上，硬盘最小存储单位是“扇区”，每个扇区存储512字节

block(块)

• 连续的八个扇区组成一个 block(4K)
• 是文件存取的最小单位

inode(索引节点)

• ·中文译名为“索引节点”，也叫节点
• ·用干存储文件元信息

inode的内容
 

inode包含文件的元信息

• 文件的字节数
• 不包含文件名
• 文件拥有者的User ID
• 文件的Group ID
• 文件的读、写、执行权限
• ·文件的时间戳

用stat命令可以查看某个文件的inode信息

• 示例:stat aa.txt
• 

Linux系统文件三个主要的时间属性

ectime(change time)最后一次改变文件或目录(属性)的时间

oatime(access time)最后一次访问文件或目录的时间

emtime(modify time)最后一次修改文件或目录(内容的时间

[root@localhost ~]# chmod +x lll.txt
[root@localhost ~]# echo 123 > lll.txt
[root@localhost ~]# stat lll.txt
  文件："lll.txt"
  大小：4         	块：8          IO 块：4096   普通文件
设备：fd00h/64768d	Inode：33581131    硬链接：1
权限：(0755/-rwxr-xr-x)  Uid：(    0/    root)   Gid：(    0/    root)
环境：unconfined_u:object_r:admin_home_t:s0
最近访问：2024-04-23 09:53:49.219232512 +0800
最近更改：2024-04-23 10:10:36.377756241 +0800
最近改动：2024-04-23 10:10:36.377756241 +0800
创建时间：-

目录文件的结构

• 目录也是一种文件·
• 目录文件的结构
• 每个inode都有一个号码，操作系统用inode号码来识别不同的文件
• Linux系统内部不使用文件名，而使用inode号码来识别文件
• 对于用户，文件名只是inode号码便于识别的别称
• 

inode的号码

用户通过文件名打开文件时，系统内部的过程

• 系统找到这个文件名对应的inode号码
• 通过inode号码，获取inode信息
• 根据inode信息，找到文件数据所在的block，读出数据

查看inode号码的方法
 

ls -i命令

查看文件名对应的inode号码

[root@localhost ~]# ls -i lll.txt
33581131 lll.txt

stat命令

查看文件inode信息中的inode号码

[root@localhost ~]# stat lll.txt
  文件："lll.txt"
  大小：4         	块：8          IO 块：4096   普通文件
设备：fd00h/64768d	Inode：33581131    硬链接：1
权限：(0755/-rwxr-xr-x)  Uid：(    0/    root)   Gid：(    0/    root)
环境：unconfined_u:object_r:admin_home_t:s0
最近访问：2024-04-23 09:53:49.219232512 +0800
最近更改：2024-04-23 10:10:36.377756241 +0800
最近改动：2024-04-23 10:10:36.377756241 +0800
创建时间：-

find ./ -inum

根据指定inode号查找文件

[root@localhost ~]# find ./ -inum 33581131
./lll.txt

 

inode的大小

inode也会消耗硬盘空间

• 每个inode的大小
• 一般是128字节或256字节

格式化文件系统时确定inode的总数

使用df -i命令可以查看每个硬盘分区的inode总数和已经使用的数量

df -i

查看每个硬盘分区的inode总数和已经使用的数量

[root@localhost ~]# df -i
文件系统                   Inode 已用(I)  可用(I) 已用(I)% 挂载点
devtmpfs                  478387     410   477977       1% /dev
tmpfs                     482656       1   482655       1% /dev/shm
tmpfs                     482656    1447   481209       1% /run
tmpfs                     482656      16   482640       1% /sys/fs/cgroup
/dev/mapper/centos-root 13629440  160950 13468490       2% /
/dev/sda1                 524288     341   523947       1% /boot
tmpfs                     482656       9   482647       1% /run/user/42
tmpfs                     482656       1   482655       1% /run/user/0

inode的特殊作用

由于inode号码与文件名分离，导致一些Unix/Linux系统具有以下的现象

• 当文件名包含特殊字符，可能无法正常删除文件，直接删除inode，也可以删除文件
• 移动或重命名文件时，只改变文件名，不影响inode号码
• 打开一个文件后，系统通过inode号码来识别该文件，不再考虑文件名

find ./ -inum 33556183 -exec rm -rf {} ; 根据inode号查找到指定文件并删除；

[root@localhost ~]# find ./ -inum 33556183 -exec rm -rf {} \;
[root@localhost ~]# ls
anaconda-ks.cfg       lll.txt  模板  图片  下载  桌面
initial-setup-ks.cfg  公共     视频  文档  音乐

重定向修改文件内容，不会更改inode号，但在vim编辑器中修改文件内容，则会导致文件的inode号发生改变；

[root@localhost ~]# vim lll.txt
[root@localhost ~]# ls -i lll.txt
33581149 lll.txt

 
二.链接文件

• 为文件或目录建立链接文件
• 链接文件分类
• 

三.文件恢复

EXT类型文件恢复

编译安装extundelete软件包

• 安装依赖包

• *e2fsprogs-libs-1.41.12-18.el6.x86 64.rpm
• *e2fsprogs-devel-1.41.12-18.el6.x86 64.rpm

• 配置、编译及安装

• *extundelete-0.2.4.tar.bz2

模拟删除并执行恢复操作

注意：extundelete工具目前只能恢复ext类型的文件

实验1模拟inode号被占满

• 模拟硬盘容量还有空间，但是文件inode号被占满的情况；

[root@localhost ~]# fdisk /dev/sdc
欢迎使用 fdisk (util-linux 2.23.2)。

更改将停留在内存中，直到您决定将更改写入磁盘。
使用写入命令前请三思。

Device does not contain a recognized partition table
使用磁盘标识符 0x029b1ebd 创建新的 DOS 磁盘标签。

命令(输入 m 获取帮助)：n
Partition type:
   p   primary (0 primary, 0 extended, 4 free)
   e   extended
Select (default p): 
Using default response p
分区号 (1-4，默认 1)：
起始 扇区 (2048-20971519，默认为 2048)：
将使用默认值 2048
Last 扇区, +扇区 or +size{K,M,G} (2048-20971519，默认为 20971519)：+10M
分区 1 已设置为 Linux 类型，大小设为 10 MiB

命令(输入 m 获取帮助)：t
已选择分区 1
Hex 代码(输入 L 列出所有代码)：8e
已将分区“Linux”的类型更改为“Linux LVM”

命令(输入 m 获取帮助)：w
The partition table has been altered!

Calling ioctl() to re-read partition table.
正在同步磁盘。
[root@localhost ~]# fdisk -l

磁盘 /dev/sdc：10.7 GB, 10737418240 字节，20971520 个扇区
Units = 扇区 of 1 * 512 = 512 bytes
扇区大小(逻辑/物理)：512 字节 / 512 字节
I/O 大小(最小/最佳)：512 字节 / 512 字节
磁盘标签类型：dos
磁盘标识符：0x029b1ebd

   设备 Boot      Start         End      Blocks   Id  System
/dev/sdc1            2048       22527       10240   8e  Linux LVM

磁盘 /dev/sda：32.2 GB, 32212254720 字节，62914560 个扇区
Units = 扇区 of 1 * 512 = 512 bytes
扇区大小(逻辑/物理)：512 字节 / 512 字节
I/O 大小(最小/最佳)：512 字节 / 512 字节
磁盘标签类型：dos
磁盘标识符：0x00094371

   设备 Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048     2099199     1048576   83  Linux
/dev/sda2         2099200    62914559    30407680   8e  Linux LVM

磁盘 /dev/sdb：10.7 GB, 10737418240 字节，20971520 个扇区
Units = 扇区 of 1 * 512 = 512 bytes
扇区大小(逻辑/物理)：512 字节 / 512 字节
I/O 大小(最小/最佳)：512 字节 / 512 字节
磁盘标签类型：dos
磁盘标识符：0x7e394ca8

   设备 Boot      Start         End      Blocks   Id  System
/dev/sdb1            2048    20971519    10484736   8e  Linux LVM

磁盘 /dev/mapper/centos-root：27.9 GB, 27913093120 字节，54517760 个扇区
Units = 扇区 of 1 * 512 = 512 bytes
扇区大小(逻辑/物理)：512 字节 / 512 字节
I/O 大小(最小/最佳)：512 字节 / 512 字节


磁盘 /dev/mapper/centos-swap：3221 MB, 3221225472 字节，6291456 个扇区
Units = 扇区 of 1 * 512 = 512 bytes
扇区大小(逻辑/物理)：512 字节 / 512 字节
I/O 大小(最小/最佳)：512 字节 / 512 字节

[root@localhost ~]# mkfs -t ext4 /dev/sdc1
mke2fs 1.42.9 (28-Dec-2013)
文件系统标签=
OS type: Linux
块大小=1024 (log=0)
分块大小=1024 (log=0)
Stride=0 blocks, Stripe width=0 blocks
2560 inodes, 10240 blocks
512 blocks (5.00%) reserved for the super user
第一个数据块=1
Maximum filesystem blocks=10485760
2 block groups
8192 blocks per group, 8192 fragments per group
1280 inodes per group
Superblock backups stored on blocks: 
	8193

Allocating group tables: 完成                            
正在写入inode表: 完成                            
Creating journal (1024 blocks): 完成
Writing superblocks and filesystem accounting information: 完成
[root@localhost ~]# mount /dev/sdc1 /lll/
[root@localhost ~]# df -hT
文件系统                类型      容量  已用  可用 已用% 挂载点
devtmpfs                devtmpfs  1.9G     0  1.9G    0% /dev
tmpfs                   tmpfs     1.9G     0  1.9G    0% /dev/shm
tmpfs                   tmpfs     1.9G   13M  1.9G    1% /run
tmpfs                   tmpfs     1.9G     0  1.9G    0% /sys/fs/cgroup
/dev/mapper/centos-root xfs        26G  5.3G   21G   21% /
/dev/sda1               xfs      1014M  187M  828M   19% /boot
tmpfs                   tmpfs     378M     0  378M    0% /run/user/0
tmpfs                   tmpfs     378M   12K  378M    1% /run/user/42
/dev/sdc1               ext4      8.7M  172K  7.9M    3% /lll
[root@localhost ~]# df -i
文件系统                   Inode 已用(I)  可用(I) 已用(I)% 挂载点
devtmpfs                  478388     431   477957       1% /dev
tmpfs                     482657       1   482656       1% /dev/shm
tmpfs                     482657    1464   481193       1% /run
tmpfs                     482657      16   482641       1% /sys/fs/cgroup
/dev/mapper/centos-root 13629440  160960 13468480       2% /
/dev/sda1                 524288     341   523947       1% /boot
tmpfs                     482657       1   482656       1% /run/user/0
tmpfs                     482657       9   482648       1% /run/user/42
/dev/sdc1                   2560      11     2549       1% /lll
[root@localhost ~]# cd /lll/
[root@localhost lll]# ls
lost+found
[root@localhost lll]# rm -rf *
[root@localhost lll]# ls
[root@localhost lll]# touch file{1..2560}
touch: 无法创建"file2551": 设备上没有空间
touch: 无法创建"file2552": 设备上没有空间
touch: 无法创建"file2553": 设备上没有空间
touch: 无法创建"file2554": 设备上没有空间
touch: 无法创建"file2555": 设备上没有空间
touch: 无法创建"file2556": 设备上没有空间
touch: 无法创建"file2557": 设备上没有空间
touch: 无法创建"file2558": 设备上没有空间
touch: 无法创建"file2559": 设备上没有空间
touch: 无法创建"file2560": 设备上没有空间
[root@localhost lll]# ls
file1     file1286  file1573  file1860  file2147  file2434  file426  file713
file10    file1287  file1574  file1861  file2148  file2435  file427  file714
file100   file1288  file1575  file1862  file2149  file2436  file428  file715
file1000  file1289  file1576  file1863  file215   file2437  file429  file716
file1001  file129   file1577  file1864  file2150  file2438  file43   file717
file1002  file1290  file1578  file1865  file2151  file2439  file430  file718
file1003  file1291  file1579  file1866  file2152  file244   file431  file719
file1004  file1292  file158   file1867  file2153  file2440  file432  file72
file1005  file1293  file1580  file1868  file2154  file2441  file433  file720
file1006  file1294  file1581  file1869  file2155  file2442  file434  file721
file1007  file1295  file1582  file187   file2156  file2443  file435  file722
file1008  file1296  file1583  file1870  file2157  file2444  file436  file723
file1009  file1297  file1584  file1871  file2158  file2445  file437  file724
file101   file1298  file1585  file1872  file2159  file2446  file438  file725
file1010  file1299  file1586  file1873  file216   file2447  file439  file726
file1011  file13    file1587  file1874  file2160  file2448  file44   file727
file1012  file130   file1588  file1875  file2161  file2449  file440  file728
file1013  file1300  file1589  file1876  file2162  file245   file441  file729
file1014  file1301  file159   file1877  file2163  file2450  file442  file73
file1015  file1302  file1590  file1878  file2164  file2451  file443  file730
file1016  file1303  file1591  file1879  file2165  file2452  file444  file731
file1017  file1304  file1592  file188   file2166  file2453  file445  file732
file1018  file1305  file1593  file1880  file2167  file2454  file446  file733
file1019  file1306  file1594  file1881  file2168  file2455  file447  file734
file102   file1307  file1595  file1882  file2169  file2456  file448  file735
file1020  file1308  file1596  file1883  file217   file2457  file449  file736
file1021  file1309  file1597  file1884  file2170  file2458  file45   file737
file1022  file131   file1598  file1885  file2171  file2459  file450  file738
file1023  file1310  file1599  file1886  file2172  file246   file451  file739
file1024  file1311  file16    file1887  file2173  file2460  file452  file74
file1025  file1312  file160   file1888  file2174  file2461  file453  file740
file1026  file1313  file1600  file1889  file2175  file2462  file454  file741
file1027  file1314  file1601  file189   file2176  file2463  file455  file742
file1028  file1315  file1602  file1890  file2177  file2464  file456  file743
file1029  file1316  file1603  file1891  file2178  file2465  file457  file744
file103   file1317  file1604  file1892  file2179  file2466  file458  file745
file1030  file1318  file1605  file1893  file218   file2467  file459  file746
file1031  file1319  file1606  file1894  file2180  file2468  file46   file747
file1032  file132   file1607  file1895  file2181  file2469  file460  file748
file1033  file1320  file1608  file1896  file2182  file247   file461  file749
file1034  file1321  file1609  file1897  file2183  file2470  file462  file75
file1035  file1322  file161   file1898  file2184  file2471  file463  file750
file1036  file1323  file1610  file1899  file2185  file2472  file464  file751
file1037  file1324  file1611  file19    file2186  file2473  file465  file752
file1038  file1325  file1612  file190   file2187  file2474  file466  file753
file1039  file1326  file1613  file1900  file2188  file2475  file467  file754
file104   file1327  file1614  file1901  file2189  file2476  file468  file755
file1040  file1328  file1615  file1902  file219   file2477  file469  file756
file1041  file1329  file1616  file1903  file2190  file2478  file47   file757
file1042  file133   file1617  file1904  file2191  file2479  file470  file758
file1043  file1330  file1618  file1905  file2192  file248   file471  file759
file1044  file1331  file1619  file1906  file2193  file2480  file472  file76
file1045  file1332  file162   file1907  file2194  file2481  file473  file760
file1046  file1333  file1620  file1908  file2195  file2482  file474  file761
file1047  file1334  file1621  file1909  file2196  file2483  file475  file762
file1048  file1335  file1622  file191   file2197  file2484  file476  file763
file1049  file1336  file1623  file1910  file2198  file2485  file477  file764
file105   file1337  file1624  file1911  file2199  file2486  file478  file765
file1050  file1338  file1625  file1912  file22    file2487  file479  file766
file1051  file1339  file1626  file1913  file220   file2488  file48   file767
file1052  file134   file1627  file1914  file2200  file2489  file480  file768
file1053  file1340  file1628  file1915  file2201  file249   file481  file769
file1054  file1341  file1629  file1916  file2202  file2490  file482  file77
file1055  file1342  file163   file1917  file2203  file2491  file483  file770
file1056  file1343  file1630  file1918  file2204  file2492  file484  file771
file1057  file1344  file1631  file1919  file2205  file2493  file485  file772
file1058  file1345  file1632  file192   file2206  file2494  file486  file773
file1059  file1346  file1633  file1920  file2207  file2495  file487  file774
file106   file1347  file1634  file1921  file2208  file2496  file488  file775
file1060  file1348  file1635  file1922  file2209  file2497  file489  file776
file1061  file1349  file1636  file1923  file221   file2498  file49   file777
file1062  file135   file1637  file1924  file2210  file2499  file490  file778
file1063  file1350  file1638  file1925  file2211  file25    file491  file779
file1064  file1351  file1639  file1926  file2212  file250   file492  file78
file1065  file1352  file164   file1927  file2213  file2500  file493  file780
file1066  file1353  file1640  file1928  file2214  file2501  file494  file781
file1067  file1354  file1641  file1929  file2215  file2502  file495  file782
file1068  file1355  file1642  file193   file2216  file2503  file496  file783
file1069  file1356  file1643  file1930  file2217  file2504  file497  file784
file107   file1357  file1644  file1931  file2218  file2505  file498  file785
file1070  file1358  file1645  file1932  file2219  file2506  file499  file786
file1071  file1359  file1646  file1933  file222   file2507  file5    file787
file1072  file136   file1647  file1934  file2220  file2508  file50   file788
file1073  file1360  file1648  file1935  file2221  file2509  file500  file789
file1074  file1361  file1649  file1936  file2222  file251   file501  file79
file1075  file1362  file165   file1937  file2223  file2510  file502  file790
file1076  file1363  file1650  file1938  file2224  file2511  file503  file791
file1077  file1364  file1651  file1939  file2225  file2512  file504  file792
file1078  file1365  file1652  file194   file2226  file2513  file505  file793
file1079  file1366  file1653  file1940  file2227  file2514  file506  file794
file108   file1367  file1654  file1941  file2228  file2515  file507  file795
file1080  file1368  file1655  file1942  file2229  file2516  file508  file796
file1081  file1369  file1656  file1943  file223   file2517  file509  file797
file1082  file137   file1657  file1944  file2230  file2518  file51   file798
file1083  file1370  file1658  file1945  file2231  file2519  file510  file799
file1084  file1371  file1659  file1946  file2232  file252   file511  file8
file1085  file1372  file166   file1947  file2233  file2520  file512  file80
file1086  file1373  file1660  file1948  file2234  file2521  file513  file800
file1087  file1374  file1661  file1949  file2235  file2522  file514  file801
file1088  file1375  file1662  file195   file2236  file2523  file515  file802
file1089  file1376  file1663  file1950  file2237  file2524  file516  file803
file109   file1377  file1664  file1951  file2238  file2525  file517  file804
file1090  file1378  file1665  file1952  file2239  file2526  file518  file805
file1091  file1379  file1666  file1953  file224   file2527  file519  file806
file1092  file138   file1667  file1954  file2240  file2528  file52   file807
file1093  file1380  file1668  file1955  file2241  file2529  file520  file808
file1094  file1381  file1669  file1956  file2242  file253   file521  file809
file1095  file1382  file167   file1957  file2243  file2530  file522  file81
file1096  file1383  file1670  file1958  file2244  file2531  file523  file810
file1097  file1384  file1671  file1959  file2245  file2532  file524  file811
file1098  file1385  file1672  file196   file2246  file2533  file525  file812
file1099  file1386  file1673  file1960  file2247  file2534  file526  file813
file11    file1387  file1674  file1961  file2248  file2535  file527  file814
file110   file1388  file1675  file1962  file2249  file2536  file528  file815
file1100  file1389  file1676  file1963  file225   file2537  file529  file816
file1101  file139   file1677  file1964  file2250  file2538  file53   file817
file1102  file1390  file1678  file1965  file2251  file2539  file530  file818
file1103  file1391  file1679  file1966  file2252  file254   file531  file819
file1104  file1392  file168   file1967  file2253  file2540  file532  file82
file1105  file1393  file1680  file1968  file2254  file2541  file533  file820
file1106  file1394  file1681  file1969  file2255  file2542  file534  file821
file1107  file1395  file1682  file197   file2256  file2543  file535  file822
file1108  file1396  file1683  file1970  file2257  file2544  file536  file823
file1109  file1397  file1684  file1971  file2258  file2545  file537  file824
file111   file1398  file1685  file1972  file2259  file2546  file538  file825
file1110  file1399  file1686  file1973  file226   file2547  file539  file826
file1111  file14    file1687  file1974  file2260  file2548  file54   file827
file1112  file140   file1688  file1975  file2261  file2549  file540  file828
file1113  file1400  file1689  file1976  file2262  file255   file541  file829
file1114  file1401  file169   file1977  file2263  file2550  file542  file83
file1115  file1402  file1690  file1978  file2264  file256   file543  file830
file1116  file1403  file1691  file1979  file2265  file257   file544  file831
file1117  file1404  file1692  file198   file2266  file258   file545  file832
file1118  file1405  file1693  file1980  file2267  file259   file546  file833
file1119  file1406  file1694  file1981  file2268  file26    file547  file834
file112   file1407  file1695  file1982  file2269  file260   file548  file835
file1120  file1408  file1696  file1983  file227   file261   file549  file836
file1121  file1409  file1697  file1984  file2270  file262   file55   file837
file1122  file141   file1698  file1985  file2271  file263   file550  file838
file1123  file1410  file1699  file1986  file2272  file264   file551  file839
file1124  file1411  file17    file1987  file2273  file265   file552  file84
file1125  file1412  file170   file1988  file2274  file266   file553  file840
file1126  file1413  file1700  file1989  file2275  file267   file554  file841
file1127  file1414  file1701  file199   file2276  file268   file555  file842
file1128  file1415  file1702  file1990  file2277  file269   file556  file843
file1129  file1416  file1703  file1991  file2278  file27    file557  file844
file113   file1417  file1704  file1992  file2279  file270   file558  file845
file1130  file1418  file1705  file1993  file228   file271   file559  file846
file1131  file1419  file1706  file1994  file2280  file272   file56   file847
file1132  file142   file1707  file1995  file2281  file273   file560  file848
file1133  file1420  file1708  file1996  file2282  file274   file561  file849
file1134  file1421  file1709  file1997  file2283  file275   file562  file85
file1135  file1422  file171   file1998  file2284  file276   file563  file850
file1136  file1423  file1710  file1999  file2285  file277   file564  file851
file1137  file1424  file1711  file2     file2286  file278   file565  file852
file1138  file1425  file1712  file20    file2287  file279   file566  file853
file1139  file1426  file1713  file200   file2288  file28    file567  file854
file114   file1427  file1714  file2000  file2289  file280   file568  file855
file1140  file1428  file1715  file2001  file229   file281   file569  file856
file1141  file1429  file1716  file2002  file2290  file282   file57   file857
file1142  file143   file1717  file2003  file2291  file283   file570  file858
file1143  file1430  file1718  file2004  file2292  file284   file571  file859
file1144  file1431  file1719  file2005  file2293  file285   file572  file86
file1145  file1432  file172   file2006  file2294  file286   file573  file860
file1146  file1433  file1720  file2007  file2295  file287   file574  file861
file1147  file1434  file1721  file2008  file2296  file288   file575  file862
file1148  file1435  file1722  file2009  file2297  file289   file576  file863
file1149  file1436  file1723  file201   file2298  file29    file577  file864
file115   file1437  file1724  file2010  file2299  file290   file578  file865
file1150  file1438  file1725  file2011  file23    file291   file579  file866
file1151  file1439  file1726  file2012  file230   file292   file58   file867
file1152  file144   file1727  file2013  file2300  file293   file580  file868
file1153  file1440  file1728  file2014  file2301  file294   file581  file869
file1154  file1441  file1729  file2015  file2302  file295   file582  file87
file1155  file1442  file173   file2016  file2303  file296   file583  file870
file1156  file1443  file1730  file2017  file2304  file297   file584  file871
file1157  file1444  file1731  file2018  file2305  file298   file585  file872
file1158  file1445  file1732  file2019  file2306  file299   file586  file873
file1159  file1446  file1733  file202   file2307  file3     file587  file874
file116   file1447  file1734  file2020  file2308  file30    file588  file875
file1160  file1448  file1735  file2021  file2309  file300   file589  file876
file1161  file1449  file1736  file2022  file231   file301   file59   file877
file1162  file145   file1737  file2023  file2310  file302   file590  file878
file1163  file1450  file1738  file2024  file2311  file303   file591  file879
file1164  file1451  file1739  file2025  file2312  file304   file592  file88
file1165  file1452  file174   file2026  file2313  file305   file593  file880
file1166  file1453  file1740  file2027  file2314  file306   file594  file881
file1167  file1454  file1741  file2028  file2315  file307   file595  file882
file1168  file1455  file1742  file2029  file2316  file308   file596  file883
file1169  file1456  file1743  file203   file2317  file309   file597  file884
file117   file1457  file1744  file2030  file2318  file31    file598  file885
file1170  file1458  file1745  file2031  file2319  file310   file599  file886
file1171  file1459  file1746  file2032  file232   file311   file6    file887
file1172  file146   file1747  file2033  file2320  file312   file60   file888
file1173  file1460  file1748  file2034  file2321  file313   file600  file889
file1174  file1461  file1749  file2035  file2322  file314   file601  file89
file1175  file1462  file175   file2036  file2323  file315   file602  file890
file1176  file1463  file1750  file2037  file2324  file316   file603  file891
file1177  file1464  file1751  file2038  file2325  file317   file604  file892
file1178  file1465  file1752  file2039  file2326  file318   file605  file893
file1179  file1466  file1753  file204   file2327  file319   file606  file894
file118   file1467  file1754  file2040  file2328  file32    file607  file895
file1180  file1468  file1755  file2041  file2329  file320   file608  file896
file1181  file1469  file1756  file2042  file233   file321   file609  file897
file1182  file147   file1757  file2043  file2330  file322   file61   file898
file1183  file1470  file1758  file2044  file2331  file323   file610  file899
file1184  file1471  file1759  file2045  file2332  file324   file611  file9
file1185  file1472  file176   file2046  file2333  file325   file612  file90
file1186  file1473  file1760  file2047  file2334  file326   file613  file900
file1187  file1474  file1761  file2048  file2335  file327   file614  file901
file1188  file1475  file1762  file2049  file2336  file328   file615  file902
file1189  file1476  file1763  file205   file2337  file329   file616  file903
file119   file1477  file1764  file2050  file2338  file33    file617  file904
file1190  file1478  file1765  file2051  file2339  file330   file618  file905
file1191  file1479  file1766  file2052  file234   file331   file619  file906
file1192  file148   file1767  file2053  file2340  file332   file62   file907
file1193  file1480  file1768  file2054  file2341  file333   file620  file908
file1194  file1481  file1769  file2055  file2342  file334   file621  file909
file1195  file1482  file177   file2056  file2343  file335   file622  file91
file1196  file1483  file1770  file2057  file2344  file336   file623  file910
file1197  file1484  file1771  file2058  file2345  file337   file624  file911
file1198  file1485  file1772  file2059  file2346  file338   file625  file912
file1199  file1486  file1773  file206   file2347  file339   file626  file913
file12    file1487  file1774  file2060  file2348  file34    file627  file914
file120   file1488  file1775  file2061  file2349  file340   file628  file915
file1200  file1489  file1776  file2062  file235   file341   file629  file916
file1201  file149   file1777  file2063  file2350  file342   file63   file917
file1202  file1490  file1778  file2064  file2351  file343   file630  file918
file1203  file1491  file1779  file2065  file2352  file344   file631  file919
file1204  file1492  file178   file2066  file2353  file345   file632  file92
file1205  file1493  file1780  file2067  file2354  file346   file633  file920
file1206  file1494  file1781  file2068  file2355  file347   file634  file921
file1207  file1495  file1782  file2069  file2356  file348   file635  file922
file1208  file1496  file1783  file207   file2357  file349   file636  file923
file1209  file1497  file1784  file2070  file2358  file35    file637  file924
file121   file1498  file1785  file2071  file2359  file350   file638  file925
file1210  file1499  file1786  file2072  file236   file351   file639  file926
file1211  file15    file1787  file2073  file2360  file352   file64   file927
file1212  file150   file1788  file2074  file2361  file353   file640  file928
file1213  file1500  file1789  file2075  file2362  file354   file641  file929
file1214  file1501  file179   file2076  file2363  file355   file642  file93
file1215  file1502  file1790  file2077  file2364  file356   file643  file930
file1216  file1503  file1791  file2078  file2365  file357   file644  file931
file1217  file1504  file1792  file2079  file2366  file358   file645  file932
file1218  file1505  file1793  file208   file2367  file359   file646  file933
file1219  file1506  file1794  file2080  file2368  file36    file647  file934
file122   file1507  file1795  file2081  file2369  file360   file648  file935
file1220  file1508  file1796  file2082  file237   file361   file649  file936
file1221  file1509  file1797  file2083  file2370  file362   file65   file937
file1222  file151   file1798  file2084  file2371  file363   file650  file938
file1223  file1510  file1799  file2085  file2372  file364   file651  file939
file1224  file1511  file18    file2086  file2373  file365   file652  file94
file1225  file1512  file180   file2087  file2374  file366   file653  file940
file1226  file1513  file1800  file2088  file2375  file367   file654  file941
file1227  file1514  file1801  file2089  file2376  file368   file655  file942
file1228  file1515  file1802  file209   file2377  file369   file656  file943
file1229  file1516  file1803  file2090  file2378  file37    file657  file944
file123   file1517  file1804  file2091  file2379  file370   file658  file945
file1230  file1518  file1805  file2092  file238   file371   file659  file946
file1231  file1519  file1806  file2093  file2380  file372   file66   file947
file1232  file152   file1807  file2094  file2381  file373   file660  file948
file1233  file1520  file1808  file2095  file2382  file374   file661  file949
file1234  file1521  file1809  file2096  file2383  file375   file662  file95
file1235  file1522  file181   file2097  file2384  file376   file663  file950
file1236  file1523  file1810  file2098  file2385  file377   file664  file951
file1237  file1524  file1811  file2099  file2386  file378   file665  file952
file1238  file1525  file1812  file21    file2387  file379   file666  file953
file1239  file1526  file1813  file210   file2388  file38    file667  file954
file124   file1527  file1814  file2100  file2389  file380   file668  file955
file1240  file1528  file1815  file2101  file239   file381   file669  file956
file1241  file1529  file1816  file2102  file2390  file382   file67   file957
file1242  file153   file1817  file2103  file2391  file383   file670  file958
file1243  file1530  file1818  file2104  file2392  file384   file671  file959
file1244  file1531  file1819  file2105  file2393  file385   file672  file96
file1245  file1532  file182   file2106  file2394  file386   file673  file960
file1246  file1533  file1820  file2107  file2395  file387   file674  file961
file1247  file1534  file1821  file2108  file2396  file388   file675  file962
file1248  file1535  file1822  file2109  file2397  file389   file676  file963
file1249  file1536  file1823  file211   file2398  file39    file677  file964
file125   file1537  file1824  file2110  file2399  file390   file678  file965
file1250  file1538  file1825  file2111  file24    file391   file679  file966
file1251  file1539  file1826  file2112  file240   file392   file68   file967
file1252  file154   file1827  file2113  file2400  file393   file680  file968
file1253  file1540  file1828  file2114  file2401  file394   file681  file969
file1254  file1541  file1829  file2115  file2402  file395   file682  file97
file1255  file1542  file183   file2116  file2403  file396   file683  file970
file1256  file1543  file1830  file2117  file2404  file397   file684  file971
file1257  file1544  file1831  file2118  file2405  file398   file685  file972
file1258  file1545  file1832  file2119  file2406  file399   file686  file973
file1259  file1546  file1833  file212   file2407  file4     file687  file974
file126   file1547  file1834  file2120  file2408  file40    file688  file975
file1260  file1548  file1835  file2121  file2409  file400   file689  file976
file1261  file1549  file1836  file2122  file241   file401   file69   file977
file1262  file155   file1837  file2123  file2410  file402   file690  file978
file1263  file1550  file1838  file2124  file2411  file403   file691  file979
file1264  file1551  file1839  file2125  file2412  file404   file692  file98
file1265  file1552  file184   file2126  file2413  file405   file693  file980
file1266  file1553  file1840  file2127  file2414  file406   file694  file981
file1267  file1554  file1841  file2128  file2415  file407   file695  file982
file1268  file1555  file1842  file2129  file2416  file408   file696  file983
file1269  file1556  file1843  file213   file2417  file409   file697  file984
file127   file1557  file1844  file2130  file2418  file41    file698  file985
file1270  file1558  file1845  file2131  file2419  file410   file699  file986
file1271  file1559  file1846  file2132  file242   file411   file7    file987
file1272  file156   file1847  file2133  file2420  file412   file70   file988
file1273  file1560  file1848  file2134  file2421  file413   file700  file989
file1274  file1561  file1849  file2135  file2422  file414   file701  file99
file1275  file1562  file185   file2136  file2423  file415   file702  file990
file1276  file1563  file1850  file2137  file2424  file416   file703  file991
file1277  file1564  file1851  file2138  file2425  file417   file704  file992
file1278  file1565  file1852  file2139  file2426  file418   file705  file993
file1279  file1566  file1853  file214   file2427  file419   file706  file994
file128   file1567  file1854  file2140  file2428  file42    file707  file995
file1280  file1568  file1855  file2141  file2429  file420   file708  file996
file1281  file1569  file1856  file2142  file243   file421   file709  file997
file1282  file157   file1857  file2143  file2430  file422   file71   file998
file1283  file1570  file1858  file2144  file2431  file423   file710  file999
file1284  file1571  file1859  file2145  file2432  file424   file711
file1285  file1572  file186   file2146  file2433  file425   file712
[root@localhost lll]# df -i
文件系统                   Inode 已用(I)  可用(I) 已用(I)% 挂载点
devtmpfs                  478388     431   477957       1% /dev
tmpfs                     482657       1   482656       1% /dev/shm
tmpfs                     482657    1464   481193       1% /run
tmpfs                     482657      16   482641       1% /sys/fs/cgroup
/dev/mapper/centos-root 13629440  160960 13468480       2% /
/dev/sda1                 524288     341   523947       1% /boot
tmpfs                     482657       1   482656       1% /run/user/0
tmpfs                     482657       9   482648       1% /run/user/42
/dev/sdc1                   2560    2560        0     100% /lll

磁盘有空间，但是仍然无法写入新文件的可能原因如下所示：

（1）inode号被占满；

（2）磁盘出现问题的情况又分为：磁盘坏道和文件系统出现问题

实验2EXT类型文件恢复

（1）使用fdisk创建分区/dev/sdd1，格式化ext3文件系统;

 

实验三

XFS类型文件恢复

（1）使用fdisk创建分区/dev/sdb1，格式化xfs文件系统；

[root@localhost ~]# fdisk /dev/sdb
欢迎使用 fdisk (util-linux 2.23.2)。

更改将停留在内存中，直到您决定将更改写入磁盘。
使用写入命令前请三思。

Device does not contain a recognized partition table
使用磁盘标识符 0x0fa9c7f3 创建新的 DOS 磁盘标签。

命令(输入 m 获取帮助)：n
Partition type:
   p   primary (0 primary, 0 extended, 4 free)
   e   extended
Select (default p): 
Using default response p
分区号 (1-4，默认 1)：
起始 扇区 (2048-20971519，默认为 2048)：
将使用默认值 2048
Last 扇区, +扇区 or +size{K,M,G} (2048-20971519，默认为 20971519)：
将使用默认值 20971519
分区 1 已设置为 Linux 类型，大小设为 10 GiB

命令(输入 m 获取帮助)：t
已选择分区 1
Hex 代码(输入 L 列出所有代码)：8e
已将分区“Linux”的类型更改为“Linux LVM”

命令(输入 m 获取帮助)：w
The partition table has been altered!

Calling ioctl() to re-read partition table.
正在同步磁盘。
[root@localhost ~]# mkfs -t xfs /dev/sdb1
meta-data=/dev/sdb1              isize=512    agcount=4, agsize=655296 blks
         =                       sectsz=512   attr=2, projid32bit=1
         =                       crc=1        finobt=0, sparse=0
data     =                       bsize=4096   blocks=2621184, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0 ftype=1
log      =internal log           bsize=4096   blocks=2560, version=2
         =                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0
[root@localhost ~]# mkdir /lll
[root@localhost ~]# mount /dev/sdb1 /lll
[root@localhost ~]# df -h
文件系统                 容量  已用  可用 已用% 挂载点
devtmpfs                 1.9G     0  1.9G    0% /dev
tmpfs                    1.9G     0  1.9G    0% /dev/shm
tmpfs                    1.9G   13M  1.9G    1% /run
tmpfs                    1.9G     0  1.9G    0% /sys/fs/cgroup
/dev/mapper/centos-root   26G  5.2G   21G   20% /
/dev/sda1               1014M  187M  828M   19% /boot
tmpfs                    378M     0  378M    0% /run/user/0
tmpfs                    378M  8.0K  378M    1% /run/user/42
/dev/sdb1                 10G   33M   10G    1% /lll

（2）使用xfsdump 命令备份整个分区；

[root@localhost ~]# cp /etc/passwd /etc/shadow /lll/
[root@localhost ~]# echo a > a
[root@localhost ~]# echo b > b
[root@localhost ~]# echo c > c
[root@localhost ~]# ls
a  anaconda-ks.cfg  b  c  initial-setup-ks.cfg  公共  模板  视频  图片  文档  下载  音乐  桌面
[root@localhost ~]# cd /lll
[root@localhost lll]# ls
passwd  shadow
[root@localhost lll]# cp /etc/passwd /etc/shadow /lll/
cp：是否覆盖"/lll/passwd"？ no
cp：是否覆盖"/lll/shadow"？ n'
[root@localhost lll]# echo c > c
[root@localhost lll]# cp /etc/passwd /etc/shadow /lll/
cp：是否覆盖"/lll/passwd"？ n
cp：是否覆盖"/lll/shadow"？ n
[root@localhost lll]# echo b > b
[root@localhost lll]# echo a > a
[root@localhost lll]# ls
a  b  c  passwd  shadow
[root@localhost lll]# mkdir 123
[root@localhost lll]# cp /etc/yum.repos.d/* 123/ -r
[root@localhost lll]# ls -R
.:
123  a  b  c  passwd  shadow

./123:
local.repo  repo.bak

./123/repo.bak:
CentOS-Base.repo  CentOS-Debuginfo.repo  CentOS-Media.repo    CentOS-Vault.repo
CentOS-CR.repo    CentOS-fasttrack.repo  CentOS-Sources.repo  CentOS-x86_64-kernel.repo
[root@localhost lll]# cd /opt/
[root@localhost opt]# rpm -q xfsdump
xfsdump-3.1.7-1.el7.x86_64
[root@localhost opt]# xfsdump -f /opt/dump_sdb1 /dev/sdb1
xfsdump: using file dump (drive_simple) strategy
xfsdump: version 3.1.7 (dump format 3.0) - type ^C for status and control

 ============================= dump label dialog ==============================

please enter label for this dump session (timeout in 300 sec)
 -> dump_sdb1
session label entered: "dump_sdb1"

 --------------------------------- end dialog ---------------------------------

xfsdump: level 0 dump of localhost.localdomain:/lll
xfsdump: dump date: Fri Apr 26 14:11:44 2024
xfsdump: session id: 93c072f9-8ebc-4b9d-8da8-bc6a3385f526
xfsdump: session label: "dump_sdb1"
xfsdump: ino map phase 1: constructing initial dump list
xfsdump: ino map phase 2: skipping (no pruning necessary)
xfsdump: ino map phase 3: skipping (only one dump stream)
xfsdump: ino map construction complete
xfsdump: estimated dump size: 91456 bytes
xfsdump: /var/lib/xfsdump/inventory created

 ============================= media label dialog =============================

please enter label for media in drive 0 (timeout in 300 sec)
 -> /dev/sdb1
media label entered: "/dev/sdb1"

 --------------------------------- end dialog ---------------------------------

xfsdump: creating dump session media file 0 (media 0, file 0)
xfsdump: dumping ino map
xfsdump: dumping directories
xfsdump: dumping non-directory files
xfsdump: ending media file
xfsdump: media file size 50160 bytes
xfsdump: dump size (non-dir files) : 24000 bytes
xfsdump: dump complete: 25 seconds elapsed
xfsdump: Dump Summary:
xfsdump:   stream 0 /opt/dump_sdb1 OK (success)
xfsdump: Dump Status: SUCCESS
[root@localhost opt]# ls
dump_sdb1  rh
[root@localhost opt]# cd /data/
-bash: cd: /data/: 没有那个文件或目录
[root@localhost opt]# cd /lll/
[root@localhost lll]# ls
123  a  b  c  passwd  shadow
[root@localhost lll]# rm -rf *
[root@localhost lll]# ls
[root@localhost lll]# cd /opt
[root@localhost opt]# ls
dump_sdb1  rh

（3）模拟数据丢失并使用 xfsrestore 命令恢复文件；

[root@localhost opt]# cd /lll/
[root@localhost lll]# ls
123  a  b  c  passwd  shadow
[root@localhost lll]# rm -rf *
[root@localhost lll]# ls
[root@localhost lll]# cd /opt
[root@localhost opt]# ls
dump_sdb1  rh

 

四.日志文件

日志的功能

• 用于记录系统、程序运行中发生的各种事件
• 通过阅读日志，有助于诊断和解决系统故障

日志文件的分类

• 内核及系统日志
• 日志格式基本相似由系统服务rsyslog统一进行管理,日志格式基本相似
• 主配置文件/etc/rsyslog.conf

用户日志

• 记录系统用户登录及退出系统的相关信息

程序日志

• 由各种应用程序独立管理的日志文件，记录格式不统一

日志保存位置

• 默认位于:/ar/log目录下

主要日志文件介绍

/var/log/messages:记录linux内核消息及名种应用程序的公共日志信息，包括启动、IO错误、网络错误、程序故障等，对于未使用独立日志文件的应用程序或服务，一般都可以从该日志文中获得相关的事件记录信息。

/var/log/cron:记录crond计划任务产生的事件信息。

/var/log/dmesg:记录linux系统在引导过程中的各种事件信息。

/var/log/maillog:记录进入或发出系统的电子邮件活动。

/var/log/lastlog:记录每个用户最近的登录事件。

/var/log/rpmpkgs:记录系统中安装的各rpm包列表信息。

/var/log/secure:记录用户认证相关的安全事件信息。

/var/log/wtmp:记录每个用户登录、注销及系统启动和停机事件。

/var/run/btmp：记录失败的、错误的登录尝试及验证事件。

内核及系统日志

日志消息的级别

日志记录的一般格式

 find [目录名] -mtime +30：查询指定目录下30天以前的文件和目录；

[root@localhost lll]# find /var/log/ -mtime +30
/var/log/samba/old
/var/log/ppp
/var/log/glusterfs
/var/log/speech-dispatcher
/var/log/chrony
/var/log/pluto/peer
/var/log/ntpstats
/var/log/libvirt/qemu
/var/log/sssd
/var/log/swtpm/libvirt/qemu
/var/log/qemu-ga
/var/log/httpd