Hi,

On Thu, Jan 10, 2019 at 11:35:13 +0100, Michal Privoznik wrote:

On 1/10/19 11:19 AM, Roosen, Nicolas wrote:

Hello, I have a strange issue I'd like to have some insights on.


We have 2 running VM, the storage pool is over NFS. Unfortunately, the backend storage folder has been deleted (so the image file in it as well, obviously) ...


Yet, the 2 VM are still up and running, with their root filesystem being mounted "rw".


- how does that work? I was expecting that with the file image being deleted, the VM would not work at all.

- since the VM is still running, is there a way to create a snapshot of it in order to re-create the image file on another storage pool ? I'm currently exploring "virsh snapshot-create-as ...", but if access to the image file is needed, it will fail.

On Linux a file is not deleted right away if there's a process that has
the file opened, which is your case. The deletion is deferred until the
last process closed the file.

In order to rescue the file you could get the PID of qemu that still has
the disk open, and then find the FD corresponding to the file and with
some magic you should be able to recover the file:

# pgrep qemu
221472

# ls -l /proc/221472/fd/ | grep deleted
lr-x------ 1 root root 64 Jan 10 11:31 29 ->
/var/lib/libvirt/images/fd.img (deleted)

(Here, 29 is the FD we're looking for)

# dd if=/proc/221472/fd/29 of=blah.img

snapshot-create-* won't work because that will instruct qemu to open the
file again which will fail because the filename is gone.

You can use 'virsh blockcopy $domname $diskname /path/to/other/location --pivot
--transient-job' to rescue this situation.

The above command will copy the full block device from qemu's point of
view (thus without any change) into the new location and then switch to
it when done.

Your VM will even continue running as it did but will use the new file.

Ah good to know, thanks for the tip !

Nicolas