[lkml]   [2003]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Tar'ing /proc ???
On Thu, 16 Jan 2003, Maciej Soltysiak wrote:

> > Normally, you do `tar -clf`
> > |________ stay on the same file-system.
> > Otherwise toy need to use --exclude /proc. Proc is a virtual
> > file-system that contains things like kcore. You can get into
> Well i think that besides kcore (and maybe kmem) you should be able
> to archive it.
> Regards,
> Maciej Soltysiak

kmem is in `/dev`. It's a device you would use if you wanted to read
all of kernel memory without locking problems.

If you really want to get a snapshot of kernel memory, then do
cat /proc/kcore >/tmp/foo. /tmp/foo can then be manipulated.
The problem is that /proc/kcore is dynamic, the mere act of
'inspecting' it modifies is. 'tar' ends up doing 'morecore',
extending the break address when it encounters this large "file".
This attempts to modify the kernel which has a lock because of
the read. The result is a deadlock. Since `cat` or `cp` use
small blocks and never have to call the kernel for additional
resources, you can use them to get a snapshot.

Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
Why is the government concerned about the lunatic fringe? Think about it.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:32    [W:0.051 / U:0.224 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site