On Thu, 16 Jan 2003, Maciej Soltysiak wrote:
> > Normally, you do `tar -clf`
> > |________ stay on the same file-system.
> > Otherwise toy need to use --exclude /proc. Proc is a virtual
> > file-system that contains things like kcore. You can get into
> Well i think that besides kcore (and maybe kmem) you should be able
> to archive it.
>
> Regards,
> Maciej Soltysiak
>
kmem is in `/dev`. It's a device you would use if you wanted to read
all of kernel memory without locking problems.
If you really want to get a snapshot of kernel memory, then do
cat /proc/kcore >/tmp/foo. /tmp/foo can then be manipulated.
The problem is that /proc/kcore is dynamic, the mere act of
'inspecting' it modifies is. 'tar' ends up doing 'morecore',
extending the break address when it encounters this large "file".
This attempts to modify the kernel which has a lock because of
the read. The result is a deadlock. Since `cat` or `cp` use
small blocks and never have to call the kernel for additional
resources, you can use them to get a snapshot.
Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
Why is the government concerned about the lunatic fringe? Think about it.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Thu Jan 23 2003 - 22:00:13 EST