Re: [libvirt-users] VM running with storage image file deleted

Thanks Michal, this is good to know. Unfortunately, "dd" complains that the file is a "Stale file handle". dd if=/proc/470/fs/27 of=/data/vmguest.img dd: failed to open '/proc/470/fs/27': Stale file handle The file was on a NFS server, but the process "qemu" is running on the VM host. Duno if it makes a difference, but anyway, it seems I cannot "dd" the FD file. I'll try a rsync of the root FS of the running guest, to "backup" as much as I can. Nicolas ________________________________ From: Michal Privoznik <mprivozn(a)redhat.com&gt; Sent: Thursday, January 10, 2019 11:35 To: Roosen, Nicolas; libvirt-users(a)redhat.com Subject: Re: [libvirt-users] VM running with storage image file deleted On 1/10/19 11:19 AM, Roosen, Nicolas wrote: On Linux a file is not deleted right away if there's a process that has the file opened, which is your case. The deletion is deferred until the last process closed the file. In order to rescue the file you could get the PID of qemu that still has the disk open, and then find the FD corresponding to the file and with some magic you should be able to recover the file: # pgrep qemu 221472 # ls -l /proc/221472/fd/ | grep deleted lr-x------ 1 root root 64 Jan 10 11:31 29 -> /var/lib/libvirt/images/fd.img (deleted) (Here, 29 is the FD we're looking for) # dd if=/proc/221472/fd/29 of=blah.img snapshot-create-* won't work because that will instruct qemu to open the file again which will fail because the filename is gone. Michal