Stefan, Fam, We are trying to keep an active shadow copy while the system is running without any need for pausing. More precisely we want to log every individual access to the drive into a database so that the entire stream of accesses could be replayed at a later time. - Chad -- Chad S. Spensky MIT Lincoln Laboratory Group 59 (Cyber Systems Assessment) Ph: (781) 981-4173 On 8/14/13 6:05 AM, "Stefan Hajnoczi" <stefanha@xxxxxxxxx> wrote: >On Wed, Aug 14, 2013 at 10:40:06AM +0800, Fam Zheng wrote: >> On Tue, 08/13 16:13, Spensky, Chad - 0559 - MITLL wrote: >> > Hi All, >> > >> > I'm working with some disk introspection on KVM, and we trying to >>create >> > a shadow image of the disk. We've hooked the functions in block.c, in >> > particular bdrv_aio_writev. However we are seeing writes go through, >> > pausing the VM, and the comparing our shadow image with the actual VM >> > image, and they aren't 100% synced up. The first 1-2 sectors appear >>to be >> > always be correct, however, after that, there are sometimes some >> > discrepancies. I believe we have exhausted most obvious bugs (malloc >> > bugs, incorrect size calculations etc.). Has anyone had any >>experience >> > with this or have any insights? >> > >> > Our methodology is as follows: >> > 1. Boot the VM. >> > 2. Pause VM. >> > 3. Copy the disk to our shadow image. >> >> How do you copy the disk, from guest or host? >> >> > 4. Perform very few reads/writes. >> >> Did you flush to disk? >> >> > 5. Pause VM. >> > 6. Compare shadow copy with active vm disk. >> > >> > And this is where we are seeing discrepancies. Any help is much >> > appreciated! We are running on Ubuntu 12.04 with a modified Debian >>build. >> > >> > - Chad >> > >> > -- >> > Chad S. Spensky >> > >> >> I think drive-backup command does just what you want, it creates a image >> and copy-on-write date from guest disk to the target, without pausing >> VM. > >Or perhaps drive-mirror. > >Maybe Chad can explain what the use case is. There is probably an >existing command that does this or that could be extended to do this >safely. > >Stefan
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
