Deleted Lvol1!

[Pippo_9]

Hi everybody.

Hard to believe, but a guy has managed to mistakenly delete lvol1 by using SAM!
And, that's the funniest things, he has no backups!!
Assume he wants to recover without reinstalling the O.S. (by the way, it is 11.11).
Any hints??

Thanks

Miguel

[Jeff Schussele]

Hi Miguel,

They better hope someone was making recovery tapes as that's the only way to recover.
Boot the tape & restore.

Then I'd suggest they limit root access because that was a pretty boneheaded move.
root PW should ONLY be given to those capable of the task - NO ONE ELSE.

Rgds,
Jeff

[Michael Steele_2]

vgcfgrestore -n /dev/vg## /dev/rdsk/cXtYdZ
vgchange -a y /dev/vg##
vgsync /dev/vg##

[Michael Steele_2]

The above will recover the LVM config, but not the data. Get data elsewhere. Tape?

[Robert-Jan Goossens]

Hi Miguel,

No Backup, not even an ignite tape ?

You could try to restore from support media and try to reconfigure the kernel.

Regards,
Robert-Jan

[Pippo_9]

Yes no backups at all, no make_recovery tape!
Lvol1 has been swept away along with /stand.

Miguel

[Mark Grant]

I think you need to export your volume groups and re-build the machine and the import them again afater.

This machine is broken now and are you ever going to trust it again if you dont re-install.

Oh, by the way, important safety tip, start implementing a backup procedure.

[Bernhard Mueller]

Miguel,
if you have a similar system where you can tar /stand, you could give it a try using it... else you will have to reinstall.

run pvdisplay to see how many free extents at the beginning of the root disk there are,
recreate lvol1 with appropirate size and strict/contiguous allocation, create a hfs filesystem on it, mount it and extract /stand from the other system.

run prep_system to create a new system file , enter SAM and change one kernel parameter slightly so that a new kernel will be generated after reboot.

run strings /etc/lvmtab and ioscan and take down which HW path is which disk and which disk belong to which vg
(most likley you will have to vgexport and vgimport)

See what happens.... but don't count on me, I am off for the weekend ;-)

Regards,
Bernhard

[Todd McDaniel_1]

Miguel,

First, your lvol1 data is lost if you dont have any backups. no salvation there.

However, I concur with copying a kernel from a similar box. So you can at least save the OS...

OR if you must Ignite it from another host's tape.

I know it goes without saying now, but I will say it. Please, please, please start backing up your system... I hope everyone's jobs are still safe.

One DDS3 tape will backup all vg00 and probably most of the remaining local disks. It has very good compression, and I think an 8gb compressed capacity.

[James Murtagh]

Deleting a logical volume won't actually remove any data within it. Just recreate the lvol or vgcfgrestore it, plus recreate the VGDA stuff with lvlnboot.

[Bernhard Mueller]

Of course!

James is right, you just need exactly the right lvcreate command. SAM just does an lvremove, which does not alter anything on the disk except the VG data itself. With lvlvnboot -b /dev/vg00/lvol1, that should do the trick.

But now I am off for the weekend!
Regards
Bernhard

[Michael Steele_2]

Yes, the data might still be there.

Worth a try. Course, there's always that odd extent or two.

:-0

[John Palmer]

I can't believe that the logical volume has been deleted. You can't lvremove a logical volume that contains a mounted filesystem, you have to unmount it first. But there's no way you can unmount /stand (or / if you don't have a seperate /stand). So Catch 22!

Is it perhaps the case that the device file /dev/vg00/lvol1 has been removed? If so, you can just recreate it with mknod:-
mknod /dev/vg00/lvol1 b 64 0x000001
mknod /dev/vg00/rlvol1 c 64 0x000001

Regards,
John

[Todd McDaniel_1]

John P,

That was a thougth in the back of my head as well... I was wondering how you can lvremove an lvol for the OS...

Miguel,

Since you said the lvol was removed via SAM, if you can offer the SAM log to show us, it would clear up a ton of confusion.

Unless the box was in single user mode, I dont see how to remove lvol1. Unless the /dev/vg*/* information was removed.

I can see that someone could rm -r /stand, but not to remove the lvol1.

[James Murtagh]

I initially thought the same but on the other hand no processes generally access /stand so it is entirely feasible to unmount it.....in fact, just tested it my workstation and it unmounted without a problem. This is where SAM is dangerous....

Miguel, as to my previous comment, if you recreate lvol1 don't newfs it - just fsck/mount /stand again.

[Denver Osborn]

what ever you do, dont shutdown/reboot! :)

all you need to do is recreate lvol1, fsck and mount. It has to be made the same size as before....

where cXtXdX is your boot disk:

# pvdisplay -v /dev/dsk/cXtXdX |more

PV0 will be the start of /stand... the last one will be right before lvol2 starts. How many PE was /stand?

now make the lvol... where PE is the number of PE from pvdisplay.

# lvcreate -n lvol1 -l PE /dev/vg00

(-l PV = ell PV)


now fsck and mount..

# fsck -F hfs -y /dev/vg00/rlvol1
# mount /stand

if it was removed from sam you may have to add the entry for /stand back to your /etc/fstab.

Also verify boot lvol is defined.
# lvlnboot -v vg00

This should fix it.

-Denver

[Denver Osborn]

oops... forgot you want to make it strict/contiguous.

syntax should be:

# lvcreate -s y -C y -n lvol1 -l PE /dev/vg00

if already created it, just use lvchange to set it...

# lvchange -s y -C y /dev/vg00/lvol1

-denver

[Thierry Poels_1]

hi,

please take Denver's golden advice:
DO NOT REBOOT OR SHUTDOWN

I would plan a big maintenance window where you have time for a full backup & possible full reinstallation & restore. Personally I think chances are small you will get this server bootable again otherwise.

good luck,
Thierry.

[Denver Osborn · Accepted solution]

It should be possible to get it up and bootable again... I tested it a 712/60 @ 11i sitting on my desk before I posted a reply (I had no fear in unmounting /stand and doing lvremove!) ;)

As long as a new filesystem wasn't laid out to the disk where /stand once was, recreating the lvol the exact same size then running fsck would get it back and mounted. From then all that would be needed is to check lvlnboot for the boot lvol and since it was removed from sam I think the /etc/fstab entry for /stand would need to be added back.

Anywho, I'm sure it can be done and I'm curious to know the end result of what they did/decided to do to fix.

-Denver

[PROJECT MANAGER]

Hi.

I've tried deleting a logical volume on RedHat Linux (lvremove)and recreating it with same size. It is the one that contains /home. Then I've run fscheck, mounted /home and checked data. Everything seems to be back and in running order!!

PM