missing files in /var

[Tom Hipsz]

Recently we had accident where content under /var was partialy deleted. What would be best approach to restore any missing files?
OS version 11.11.0406 on HPc8000

[Adisuria Wangsadinata_1 · Accepted solution]

Hi,

Hope you have a good backup on your OS.
Restore from your backup is the best way you can do for this issue.

Did you know which files that has been deleted under your /var ?

Hope this information can help you.

Cheers,
AW

[Tom Hipsz]

Unfortunately we didn't make backup of /var.
It's hard to pinpoint which files were deleted. The system is still operational but not %100 as before. For example X and NSF is affected.
Would base OS or patch bundle installation help?

[Sandman!]

If you have a recovery tape for the root volume group (vg00) you can restore it from there.

[Tom Hipsz]

To clarify the status backup, we haven't made any backup of this machine yet.

Since restoring files from CD or update might not be an option, can I do anything with files in /var/lost+found?
The difficulty with this files is to identify where they belong and what is the correct file or directory name.

[Adisuria Wangsadinata_1]

Hi Tom,

You dont have a backup for your system and you didnt have also the Ignite/UX backup tape.

HP-UX is different with Windows, so when some files has been deleted ... it will deleted for good, no 'recycle bin' for HP-UX ... so if you check /var/lost+found directory, there's nothing in there (at least someone copy the file(s) into this directory).

I refer you to boot the system with Core OS (Instal and Recovery CD) and choose 'recovery' to resolve this issue. But this only help if you lost some amount of files only. If files are too much, you need to re-install the whole thing from the scrab.

Again, this is a good lesson for you to create a backup or at least a recovery tape (by using Ignite/UX feature) after the system has been setup for the 1st time. At least this will make life more easier in the future.

Hope this information can help you.

Cheers,
AW

[Adisuria Wangsadinata_1]

Hi Tom,

Addendum :

If possible before you do a recovery from the CD, do the backup first.

Cheers,
AW

[Devender Khatana]

Hi,

The contents of /var can be viewed from some other similar system but that also will not help much as still you still require contents. Which shall not work by restoring from other machine but can try that as well.

HTH,
Devender

[Torsten.]

deleted files are gone. since you have no backup, you might do a fresh install to get a stable system. Of course, you can compare the files with a working system and restore the missing files from there, but this is not safe. Perhaps you have another "healthy" system. in this case do a ignite backup from this system and restore it (interactive to change settings like hostname, ip ...) to the machine.

[rmueller58]

No backups, OUCH!! I can't imagine the fallout from such a scenario..

If you have no way to require the base.. Was the deletion the result of "root" user? you could "possibly" check lost+found, but the likelihood of any file survival is slim to none.

Reinstall from OS cd.. Then Restore from most recent tape or DVD backup

We've setup some policies and procedures to CYA in the event of a catestrophic failure.

1. Ignite the OS.. (Get to know it and love it!)
2. fbackup nightly of all mountable file systems..
3. Databases are exported or archived nightly and placed on a different device. ( export and tarball the export and place on an NFS mounted snap system..)

If your system is system critical, in order to create and Ignite you will have to have a good base from which to start, do a search in the KB on Ignite after you get your OS recovered..

Sorry to hear about the problem.. My system is 11.00.. with current patch level. See if anyone one from HP could provide a listing of the files in the base install for UX in /var/ If you have a SW support contract someone from HP could possibly assist in this. I am not sure if you can extract a portion of the CD (which might be the 1st thing to pursue prior to a complete reinstall)

[rmueller58]

X11 lost+found preserve spool tombstones
adm mail rbootd statmon uucp
dt news run stm yp
home opt sam tmp


the above are the directories in my /var

Each of which may have files or file links, the more I think about it, doing a backup from current is important.. The restore OS from CD.

[Sยภเl Kย๓คг]

Hi,

Do u have any other machine there with the same os and same softwares loaded. It's just a suggestion, I am not assuring you that It work 100%. But as you need to start from the scractch just give try. Take the backup of /var of the other machine, try restoring it. U may have to reconfigure some of the software products after a successful restoration.

ENSURE THAT YOU TAKE PROPER BACKUP AT LEAST FROM NOW ONWARDS.
An ignite baskup or a simple root backup by fbackup will also do.

Regards,
Sunil

[rmueller58]

Keep in mind any OS and rev patches in /var/adm/sw without these