The easiest way to find out how much media you’ll need to hold an archive is to make a dry run first. If you’re using tar to create the archive, use the same options that you plan to use when you create the real backup, but pipe the results to wc -c instead of writing it to media:

# tar -cvplf - backupcontents | wc -c

The -f - option tells tar to write the archive to its standard output stream. When tar completes, wc displays the total number of bytes required to hold the archive. If you plan to create a compressed archive, be sure to include the compression option when you compute the archive size; otherwise, you’ll overestimate the amount of media that you need. For example, if you use bzip2 compression to create an archive, calculate the archive size like this:

# tar -jcvplf - backupcontents | wc -c

The -j flag tells tar to use bzip2 compression; use -z if you want to use gzip compression instead.

You need superuser privileges to back up files that aren’t your own.

Creating Data Archives with tar

tar is an archive tool that you can use to create backups. It’s been around for a long time, it’s stable, and it’s relatively easy to use. Much of the data and programs out on the Web are distributed as compressed tar archives (affectionately known as tarballs). tar runs just about everywhere — Linux, UNIX, Windows, and Mac — so the archives that you create are portable. It’s included in even the most basic of Linux installations, so you don’t need to spend any time installing it.

tar also has the advantage of knowing how to manage incremental and differential backups. That’s a huge bonus if you’re an administrator on a tight media budget. Of course, you can compress archives as you create them, saving even more time and money.

Backing up files and directories

Before you start a backup, use the lsof command to be sure files aren’t in use. The command lsof | grep directoryname will tell you if any files are open in the directoryname directory tree. If the fourth column has any u’s or w’s in it, someone has a file open in update or write mode. See Technique 36 for more information about using lsof.

To archive a single file or directory with tar, enter the following command:

# tar -cvzf archivename filename

Here’s a breakdown of this command:

The -c flag tells tar to create an archive.

The -v flag tells tar to run in verbose mode (listing the archive content as it’s created).

The -z flag compresses the archive using gzip compression.

The -f archivename option tells tar where to write the archive. archivename can name a data file, a device name, or - (standard output stream).

You can follow the first filename with more file and directory names to write multiple files to the same archive.

tar can write archives to files, to devices, or to - (standard output). Use the - to pipe the archive to other commands.

In our examples, we use /dev/rmt0 as the device name — a pretty common name for a tape drive.

Backing up account information and passwords

Use the following command to back up user account information and passwords:

#tar -cvzf /dev/rmt0 \ /etc/passwd /etc/shadow

This command tells tar to create a gzip-compressed archive containing the /etc/passwd file and the /etc/shadow directory and write the archive to a tape drive (/dev/rmt0).

Any user can read the user account information stored in /etc/password, but you must be the superuser to read the /etc/shadow file (where the passwords are really stored).

Targeting bite-sized backups for speedier restores

Keeping individual backups of the data that you’re most likely to need is a good idea — especially if you use differential backups on a long backup cycle. Instead of doing a complete restore cycle just to recover the lost home directory of one sad user, you can unpack the lost data from a small archive.

Here are a few directories that you may want to archive separately to avoid a lengthy restore cycle:

/home: The /home directory contains the home directories of all the system users.

/etc: The /etc directory contains most system configuration files.

/spool: The /spool directory contains mailboxes and print files.

To back up the /home directory and the /home/user directories of all users, use the following command:

# tar -cvzf /dev/rmt0 /home

The tar command automatically recurses into subdirectories, which means all files and subdirectories underneath the parent are included in the new archive.

Rolling whole file systems into a tarball

Use the tar command to back up an entire file system by adding the -l flag to the command:

# tar -cvlzf /dev/rmt0 filesystem

The -l (lowercase L) option tells tar to stay within the given filesystem. That’s important if you think that filesystem might contain mount points for other file systems.

To back up multiple file systems, append a list of the file system names to the end of the command. To find a complete list of the file systems on your system, use the mount command with superuser privileges:

# mount

The mount command returns a list of file systems that looks similar to the list shown in Figure 50-1.

• Figure 50-1: The file system listing.

Use the listing to find the mounted file systems you want to include in the backup.

If you need to create a multitape archive, add the -M flag to the command:

# tar -cvlzfM /dev/rmt0 filesystemname

The -M flag won’t help if you’re using CDs or DVDs to hold your archives, but we show you how to create multidisc backup sets in the section, “Backing Up to CD (Or DVD) with cdbackup,” later in this chapter.

Starting a Differential

Backup Cycle

You can use the tar command to create incremental or differential backups. We explain the subtle differences between incremental and differential backups in Technique 49. You may want to check out that technique before deciding on the type that’s right for you.

Each time you create a backup in a differential or incremental cycle, you include an extra command line option:

-g snapshotFileName

The snapshot file keeps track of which files and directories you’ve written to an archive. The next time you create an archive using the same snapshot file, tar saves only those files that have changed since the previous backup. (It knows which files to save by comparing the current state of your disk with the information saved in the snapshot.)

It’s a good idea to store tar snapshot files in a directory that you aren’t likely to clean out on a regular basis. Don’t put the log files in the /tmp or /var/log directories. Instead, create a separate directory to hold snapshot files. In our examples, we assume that you want to store snapshot files in /backups.

For a differential (or incremental) backup scheme, you start each cycle by creating a full backup. tar creates a snapshot file that records the fact that the archive contains a complete copy of everything that you want to save.

To employ a differential backup cycle, follow these steps:

1. On the first day of the backup cycle (assume it’s

Monday for this example), start by removing the log file:

2. Next, create a full backup with the following command:

# tar -cvlfz /dev/rmt0 \ -g /backups/etc.snap /etc

Substitute your tape drive name for /dev/rmt0.

This command backs up the /etc directory and everything underneath it. If you want to back up more file systems, just append the names to the end of the command line (and choose a more meaningful name for the snapshot file).

Store the backup tape somewhere safe, like in a fireproof safe or an off-site location.

3. On the second day of the cycle (Tuesday), use the same command:

# tar -cvlfz /dev/rmt0 \ -g /backups/etc.snap /etc

This time, tar compares /backups/etc.snap to the current state of the /etc directory tree and saves only those files that have changed (or new files).

tar also updates the snapshot file to reflect the new state of your archive collection.

Store this backup in a safe place.

4. On the third day (Wednesday), use the same command:

# tar -cvlfz /dev/rmt0 \ -g /backups/etc.snap /etc

Again, tar compares the snapshot to the current state of the /etc directory tree. But this time, the snapshot records the archive cycle as of the end of the day on Tuesday. So, the archive you create on Wednesday contains only the files that have changed since Tuesday. When it’s finished, tar updates the snapshot file to reflect the state of your archive collection.

Wednesday’s archive stores only the changes made between Tuesday and Wednesday. The changes made between Monday and Tuesday are in the first differential archive.

Store Wednesday’s tape with Monday’s and Tuesday’s tapes. If you need to restore from backup, you need all the tapes to capture an accurate picture of all the changes made to the /etc directory tree.

You can see the pattern start to form. This cycle goes on and on until you start over again with a full backup. Each time you start the cycle, delete the snapshot file first so that the first archive is a complete backup.

Keep at least two cycles of media to be sure that you have a backup to restore from in case of emergency.

On the upside, although it takes a lot of media to create a differential backup, it takes less time because each backup represents only one day’s worth of changes.

On the downside, if you need to restore data, you have to restore all the days in the backup cycle.

Starting an Incremental

Backup Cycle

Incremental backups are a bit confusing at first, but the concept is simple when you understand it. An incremental backup works very much like a differential backup, except you have to manage the snapshot file more carefully.

A differential backup saves only the files that have changed since the most recent backup. An incremental backup saves only the files that have changed since the most recent complete backup. In other

words, an incremental backup contains everything that’s changed since the start of the cycle.

tar uses a snapshot file to decide which files it needs to save. tar only saves files changed since the snapshot was last updated.

So how do you get tar to save all files changed since the beginning of the cycle? Simple — throw out the update snapshot file after each incremental backup. If you start an incremental cycle every Monday, you want tar to use Monday’s snapshot file on Tuesday, Wednesday, Thursday, and Friday. (With a differential scheme, you use Monday’s snapshot on Tuesday, Tuesday’s snapshot on Wednesday, Wednesday’s snapshot on Thursday, and so on.) Shuffling snapshot files might seem like an odd way to get a good backup, but it does work.

The advantage to an incremental backup scheme is when you have to restore lost data. You restore the first archive in the cycle and the last archive — you don’t have to apply all the intermediate archives like you would in a differential scheme. That might not sound like a big timesaver, but if your backup cycle is

30 days long instead of 7, you get to go home for the weekend instead of shuffling tapes.

Follow these steps to start an incremental backup cycle:

1. On the first day of the backup cycle (assume it’s

Monday for this example), start by removing the log file:

#rm /backups/etc.snap

2.Create a full backup with the following command:

#tar -cvlfz /dev/rmt0 \

-g /backups/etc.snap /etc

Store the backup tape somewhere safe.