目录
一.inode & block
inode和block概述
block(块)
inode(索引节点)编辑
inode的内容
inode包含文件的元信息
用stat命令可以查看某个文件的inode信息
Linux系统文件三个主要的时间属性
目录文件的结构
inode的号码
用户通过文件名打开文件时，系统内部的过程
查看inode号码的方法
inode的大小
inode也会消耗硬盘空间
格式化文件系统时确定inode的总数
使用df -i命令可以查看每个硬盘分区的inode总数和已经使用的数量
inode的特殊作用
由于inode号码与文件名分离，导致一些Unix/Linux系统具有以下的现象
编辑 二.链接文件
三.文件恢复
EXT类型文件恢复
编译安装extundelete软件包
安装依赖包
配置、编译及安装
模拟删除并执行恢复操作
注意：extundelete工具目前只能恢复ext类型的文件
磁盘有空间，但是仍然无法写入新文件的可能原因如下所示：
编辑
编辑
编辑
实验三
XFS类型文件恢复
（2）使用xfsdump 命令备份整个分区；
编辑
编辑
（3）模拟数据丢失并使用 xfsrestore 命令恢复文件；
四.日志文件
日志的功能
日志文件的分类
用户日志
程序日志
日志保存位置
主要日志文件介绍
内核及系统日志
日志消息的级别
日志记录的一般格式
一.inode & block
inode和block概述
- 文件数据包括元信息与实际数据
- 文件存储在硬盘上，硬盘最小存储单位是“扇区”，每个扇区存储512字节
block(块)
- 连续的八个扇区组成一个 block(4K)
- 是文件存取的最小单位
inode(索引节点)
- ·中文译名为“索引节点”，也叫节点
- ·用干存储文件元信息
inode的内容
inode包含文件的元信息
- 文件的字节数
- 不包含文件名
- 文件拥有者的User ID
- 文件的Group ID
- 文件的读、写、执行权限
- ·文件的时间戳
用stat命令可以查看某个文件的inode信息
- 示例:stat aa.txt
Linux系统文件三个主要的时间属性
ectime(change time)最后一次改变文件或目录(属性)的时间
oatime(access time)最后一次访问文件或目录的时间
emtime(modify time)最后一次修改文件或目录(内容的时间
[root@localhost ~]# chmod +x lll.txt
[root@localhost ~]# echo 123 > lll.txt
[root@localhost ~]# stat lll.txt文件："lll.txt"大小：4 块：8 IO 块：4096 普通文件
设备：fd00h/64768d Inode：33581131 硬链接：1
权限：(0755/-rwxr-xr-x) Uid：( 0/ root) Gid：( 0/ root)
环境：unconfined_u:object_r:admin_home_t:s0
最近访问：2024-04-23 09:53:49.219232512 +0800
最近更改：2024-04-23 10:10:36.377756241 +0800
最近改动：2024-04-23 10:10:36.377756241 +0800
创建时间：-
目录文件的结构
- 目录也是一种文件·
- 目录文件的结构
- 每个inode都有一个号码，操作系统用inode号码来识别不同的文件
- Linux系统内部不使用文件名，而使用inode号码来识别文件
- 对于用户，文件名只是inode号码便于识别的别称
inode的号码
用户通过文件名打开文件时，系统内部的过程
- 系统找到这个文件名对应的inode号码
- 通过inode号码，获取inode信息
- 根据inode信息，找到文件数据所在的block，读出数据
查看inode号码的方法
ls -i命令
查看文件名对应的inode号码
[root@localhost ~]# ls -i lll.txt
33581131 lll.txt
stat命令
查看文件inode信息中的inode号码
[root@localhost ~]# stat lll.txt文件："lll.txt"大小：4 块：8 IO 块：4096 普通文件
设备：fd00h/64768d Inode：33581131 硬链接：1
权限：(0755/-rwxr-xr-x) Uid：( 0/ root) Gid：( 0/ root)
环境：unconfined_u:object_r:admin_home_t:s0
最近访问：2024-04-23 09:53:49.219232512 +0800
最近更改：2024-04-23 10:10:36.377756241 +0800
最近改动：2024-04-23 10:10:36.377756241 +0800
创建时间：-
find ./ -inum
根据指定inode号查找文件
[root@localhost ~]# find ./ -inum 33581131
./lll.txt
inode的大小
inode也会消耗硬盘空间
- 每个inode的大小
- 一般是128字节或256字节
格式化文件系统时确定inode的总数
使用df -i命令可以查看每个硬盘分区的inode总数和已经使用的数量
df -i
查看每个硬盘分区的inode总数和已经使用的数量
[root@localhost ~]# df -i
文件系统 Inode 已用(I) 可用(I) 已用(I)% 挂载点
devtmpfs 478387 410 477977 1% /dev
tmpfs 482656 1 482655 1% /dev/shm
tmpfs 482656 1447 481209 1% /run
tmpfs 482656 16 482640 1% /sys/fs/cgroup
/dev/mapper/centos-root 13629440 160950 13468490 2% /
/dev/sda1 524288 341 523947 1% /boot
tmpfs 482656 9 482647 1% /run/user/42
tmpfs 482656 1 482655 1% /run/user/0
inode的特殊作用
由于inode号码与文件名分离，导致一些Unix/Linux系统具有以下的现象
- 当文件名包含特殊字符，可能无法正常删除文件，直接删除inode，也可以删除文件
- 移动或重命名文件时，只改变文件名，不影响inode号码
- 打开一个文件后，系统通过inode号码来识别该文件，不再考虑文件名
find ./ -inum 33556183 -exec rm -rf {} ; 根据inode号查找到指定文件并删除；
[root@localhost ~]# find ./ -inum 33556183 -exec rm -rf {} \;
[root@localhost ~]# ls
anaconda-ks.cfg lll.txt 模板 图片 下载 桌面
initial-setup-ks.cfg 公共 视频 文档 音乐
重定向修改文件内容，不会更改inode号，但在vim编辑器中修改文件内容，则会导致文件的inode号发生改变；
[root@localhost ~]# vim lll.txt
[root@localhost ~]# ls -i lll.txt
33581149 lll.txt
二.链接文件
- 为文件或目录建立链接文件
- 链接文件分类
三.文件恢复
EXT类型文件恢复
编译安装extundelete软件包
-
安装依赖包
- *e2fsprogs-libs-1.41.12-18.el6.x86 64.rpm
- *e2fsprogs-devel-1.41.12-18.el6.x86 64.rpm
-
配置、编译及安装
- *extundelete-0.2.4.tar.bz2
模拟删除并执行恢复操作
注意：extundelete工具目前只能恢复ext类型的文件
实验1模拟inode号被占满
- 模拟硬盘容量还有空间，但是文件inode号被占满的情况；
[root@localhost ~]# fdisk /dev/sdc
欢迎使用 fdisk (util-linux 2.23.2)。更改将停留在内存中，直到您决定将更改写入磁盘。
使用写入命令前请三思。Device does not contain a recognized partition table
使用磁盘标识符 0x029b1ebd 创建新的 DOS 磁盘标签。命令(输入 m 获取帮助)：n
Partition type:p primary (0 primary, 0 extended, 4 free)e extended
Select (default p):
Using default response p
分区号 (1-4，默认 1)：
起始 扇区 (2048-20971519，默认为 2048)：
将使用默认值 2048
Last 扇区, +扇区 or +size{K,M,G} (2048-20971519，默认为 20971519)：+10M
分区 1 已设置为 Linux 类型，大小设为 10 MiB命令(输入 m 获取帮助)：t
已选择分区 1
Hex 代码(输入 L 列出所有代码)：8e
已将分区“Linux”的类型更改为“Linux LVM”命令(输入 m 获取帮助)：w
The partition table has been altered!Calling ioctl() to re-read partition table.
正在同步磁盘。
[root@localhost ~]# fdisk -l磁盘 /dev/sdc：10.7 GB, 10737418240 字节，20971520 个扇区
Units = 扇区 of 1 * 512 = 512 bytes
扇区大小(逻辑/物理)：512 字节 / 512 字节
I/O 大小(最小/最佳)：512 字节 / 512 字节
磁盘标签类型：dos
磁盘标识符：0x029b1ebd设备 Boot Start End Blocks Id System
/dev/sdc1 2048 22527 10240 8e Linux LVM磁盘 /dev/sda：32.2 GB, 32212254720 字节，62914560 个扇区
Units = 扇区 of 1 * 512 = 512 bytes
扇区大小(逻辑/物理)：512 字节 / 512 字节
I/O 大小(最小/最佳)：512 字节 / 512 字节
磁盘标签类型：dos
磁盘标识符：0x00094371设备 Boot Start End Blocks Id System
/dev/sda1 * 2048 2099199 1048576 83 Linux
/dev/sda2 2099200 62914559 30407680 8e Linux LVM磁盘 /dev/sdb：10.7 GB, 10737418240 字节，20971520 个扇区
Units = 扇区 of 1 * 512 = 512 bytes
扇区大小(逻辑/物理)：512 字节 / 512 字节
I/O 大小(最小/最佳)：512 字节 / 512 字节
磁盘标签类型：dos
磁盘标识符：0x7e394ca8设备 Boot Start End Blocks Id System
/dev/sdb1 2048 20971519 10484736 8e Linux LVM磁盘 /dev/mapper/centos-root：27.9 GB, 27913093120 字节，54517760 个扇区
Units = 扇区 of 1 * 512 = 512 bytes
扇区大小(逻辑/物理)：512 字节 / 512 字节
I/O 大小(最小/最佳)：512 字节 / 512 字节磁盘 /dev/mapper/centos-swap：3221 MB, 3221225472 字节，6291456 个扇区
Units = 扇区 of 1 * 512 = 512 bytes
扇区大小(逻辑/物理)：512 字节 / 512 字节
I/O 大小(最小/最佳)：512 字节 / 512 字节[root@localhost ~]# mkfs -t ext4 /dev/sdc1
mke2fs 1.42.9 (28-Dec-2013)
文件系统标签=
OS type: Linux
块大小=1024 (log=0)
分块大小=1024 (log=0)
Stride=0 blocks, Stripe width=0 blocks
2560 inodes, 10240 blocks
512 blocks (5.00%) reserved for the super user
第一个数据块=1
Maximum filesystem blocks=10485760
2 block groups
8192 blocks per group, 8192 fragments per group
1280 inodes per group
Superblock backups stored on blocks: 8193Allocating group tables: 完成
正在写入inode表: 完成
Creating journal (1024 blocks): 完成
Writing superblocks and filesystem accounting information: 完成
[root@localhost ~]# mount /dev/sdc1 /lll/
[root@localhost ~]# df -hT
文件系统 类型 容量 已用 可用 已用% 挂载点
devtmpfs devtmpfs 1.9G 0 1.9G 0% /dev
tmpfs tmpfs 1.9G 0 1.9G 0% /dev/shm
tmpfs tmpfs 1.9G 13M 1.9G 1% /run
tmpfs tmpfs 1.9G 0 1.9G 0% /sys/fs/cgroup
/dev/mapper/centos-root xfs 26G 5.3G 21G 21% /
/dev/sda1 xfs 1014M 187M 828M 19% /boot
tmpfs tmpfs 378M 0 378M 0% /run/user/0
tmpfs tmpfs 378M 12K 378M 1% /run/user/42
/dev/sdc1 ext4 8.7M 172K 7.9M 3% /lll
[root@localhost ~]# df -i
文件系统 Inode 已用(I) 可用(I) 已用(I)% 挂载点
devtmpfs 478388 431 477957 1% /dev
tmpfs 482657 1 482656 1% /dev/shm
tmpfs 482657 1464 481193 1% /run
tmpfs 482657 16 482641 1% /sys/fs/cgroup
/dev/mapper/centos-root 13629440 160960 13468480 2% /
/dev/sda1 524288 341 523947 1% /boot
tmpfs 482657 1 482656 1% /run/user/0
tmpfs 482657 9 482648 1% /run/user/42
/dev/sdc1 2560 11 2549 1% /lll
[root@localhost ~]# cd /lll/
[root@localhost lll]# ls
lost+found
[root@localhost lll]# rm -rf *
[root@localhost lll]# ls
[root@localhost lll]# touch file{1..2560}
touch: 无法创建"file2551": 设备上没有空间
touch: 无法创建"file2552": 设备上没有空间
touch: 无法创建"file2553": 设备上没有空间
touch: 无法创建"file2554": 设备上没有空间
touch: 无法创建"file2555": 设备上没有空间
touch: 无法创建"file2556": 设备上没有空间
touch: 无法创建"file2557": 设备上没有空间
touch: 无法创建"file2558": 设备上没有空间
touch: 无法创建"file2559": 设备上没有空间
touch: 无法创建"file2560": 设备上没有空间
[root@localhost lll]# ls
file1 file1286 file1573 file1860 file2147 file2434 file426 file713
file10 file1287 file1574 file1861 file2148 file2435 file427 file714
file100 file1288 file1575 file1862 file2149 file2436 file428 file715
file1000 file1289 file1576 file1863 file215 file2437 file429 file716
file1001 file129 file1577 file1864 file2150 file2438 file43 file717
file1002 file1290 file1578 file1865 file2151 file2439 file430 file718
file1003 file1291 file1579 file1866 file2152 file244 file431 file719
file1004 file1292 file158 file1867 file2153 file2440 file432 file72
file1005 file1293 file1580 file1868 file2154 file2441 file433 file720
file1006 file1294 file1581 file1869 file2155 file2442 file434 file721
file1007 file1295 file1582 file187 file2156 file2443 file435 file722
file1008 file1296 file1583 file1870 file2157 file2444 file436 file723
file1009 file1297 file1584 file1871 file2158 file2445 file437 file724
file101 file1298 file1585 file1872 file2159 file2446 file438 file725
file1010 file1299 file1586 file1873 file216 file2447 file439 file726
file1011 file13 file1587 file1874 file2160 file2448 file44 file727
file1012 file130 file1588 file1875 file2161 file2449 file440 file728
file1013 file1300 file1589 file1876 file2162 file245 file441 file729
file1014 file1301 file159 file1877 file2163 file2450 file442 file73
file1015 file1302 file1590 file1878 file2164 file2451 file443 file730
file1016 file1303 file1591 file1879 file2165 file2452 file444 file731
file1017 file1304 file1592 file188 file2166 file2453 file445 file732
file1018 file1305 file1593 file1880 file2167 file2454 file446 file733
file1019 file1306 file1594 file1881 file2168 file2455 file447 file734
file102 file1307 file1595 file1882 file2169 file2456 file448 file735
file1020 file1308 file1596 file1883 file217 file2457 file449 file736
file1021 file1309 file1597 file1884 file2170 file2458 file45 file737
file1022 file131 file1598 file1885 file2171 file2459 file450 file738
file1023 file1310 file1599 file1886 file2172 file246 file451 file739
file1024 file1311 file16 file1887 file2173 file2460 file452 file74
file1025 file1312 file160 file1888 file2174 file2461 file453 file740
file1026 file1313 file1600 file1889 file2175 file2462 file454 file741
file1027 file1314 file1601 file189 file2176 file2463 file455 file742
file1028 file1315 file1602 file1890 file2177 file2464 file456 file743
file1029 file1316 file1603 file1891 file2178 file2465 file457 file744
file103 file1317 file1604 file1892 file2179 file2466 file458 file745
file1030 file1318 file1605 file1893 file218 file2467 file459 file746
file1031 file1319 file1606 file1894 file2180 file2468 file46 file747
file1032 file132 file1607 file1895 file2181 file2469 file460 file748
file1033 file1320 file1608 file1896 file2182 file247 file461 file749
file1034 file1321 file1609 file1897 file2183 file2470 file462 file75
file1035 file1322 file161 file1898 file2184 file2471 file463 file750
file1036 file1323 file1610 file1899 file2185 file2472 file464 file751
file1037 file1324 file1611 file19 file2186 file2473 file465 file752
file1038 file1325 file1612 file190 file2187 file2474 file466 file753
file1039 file1326 file1613 file1900 file2188 file2475 file467 file754
file104 file1327 file1614 file1901 file2189 file2476 file468 file755
file1040 file1328 file1615 file1902 file219 file2477 file469 file756
file1041 file1329 file1616 file1903 file2190 file2478 file47 file757
file1042 file133 file1617 file1904 file2191 file2479 file470 file758
file1043 file1330 file1618 file1905 file2192 file248 file471 file759
file1044 file1331 file1619 file1906 file2193 file2480 file472 file76
file1045 file1332 file162 file1907 file2194 file2481 file473 file760
file1046 file1333 file1620 file1908 file2195 file2482 file474 file761
file1047 file1334 file1621 file1909 file2196 file2483 file475 file762
file1048 file1335 file1622 file191 file2197 file2484 file476 file763
file1049 file1336 file1623 file1910 file2198 file2485 file477 file764
file105 file1337 file1624 file1911 file2199 file2486 file478 file765
file1050 file1338 file1625 file1912 file22 file2487 file479 file766
file1051 file1339 file1626 file1913 file220 file2488 file48 file767
file1052 file134 file1627 file1914 file2200 file2489 file480 file768
file1053 file1340 file1628 file1915 file2201 file249 file481 file769
file1054 file1341 file1629 file1916 file2202 file2490 file482 file77
file1055 file1342 file163 file1917 file2203 file2491 file483 file770
file1056 file1343 file1630 file1918 file2204 file2492 file484 file771
file1057 file1344 file1631 file1919 file2205 file2493 file485 file772
file1058 file1345 file1632 file192 file2206 file2494 file486 file773
file1059 file1346 file1633 file1920 file2207 file2495 file487 file774
file106 file1347 file1634 file1921 file2208 file2496 file488 file775
file1060 file1348 file1635 file1922 file2209 file2497 file489 file776
file1061 file1349 file1636 file1923 file221 file2498 file49 file777
file1062 file135 file1637 file1924 file2210 file2499 file490 file778
file1063 file1350 file1638 file1925 file2211 file25 file491 file779
file1064 file1351 file1639 file1926 file2212 file250 file492 file78
file1065 file1352 file164 file1927 file2213 file2500 file493 file780
file1066 file1353 file1640 file1928 file2214 file2501 file494 file781
file1067 file1354 file1641 file1929 file2215 file2502 file495 file782
file1068 file1355 file1642 file193 file2216 file2503 file496 file783
file1069 file1356 file1643 file1930 file2217 file2504 file497 file784
file107 file1357 file1644 file1931 file2218 file2505 file498 file785
file1070 file1358 file1645 file1932 file2219 file2506 file499 file786
file1071 file1359 file1646 file1933 file222 file2507 file5 file787
file1072 file136 file1647 file1934 file2220 file2508 file50 file788
file1073 file1360 file1648 file1935 file2221 file2509 file500 file789
file1074 file1361 file1649 file1936 file2222 file251 file501 file79
file1075 file1362 file165 file1937 file2223 file2510 file502 file790
file1076 file1363 file1650 file1938 file2224 file2511 file503 file791
file1077 file1364 file1651 file1939 file2225 file2512 file504 file792
file1078 file1365 file1652 file194 file2226 file2513 file505 file793
file1079 file1366 file1653 file1940 file2227 file2514 file506 file794
file108 file1367 file1654 file1941 file2228 file2515 file507 file795
file1080 file1368 file1655 file1942 file2229 file2516 file508 file796
file1081 file1369 file1656 file1943 file223 file2517 file509 file797
file1082 file137 file1657 file1944 file2230 file2518 file51 file798
file1083 file1370 file1658 file1945 file2231 file2519 file510 file799
file1084 file1371 file1659 file1946 file2232 file252 file511 file8
file1085 file1372 file166 file1947 file2233 file2520 file512 file80
file1086 file1373 file1660 file1948 file2234 file2521 file513 file800
file1087 file1374 file1661 file1949 file2235 file2522 file514 file801
file1088 file1375 file1662 file195 file2236 file2523 file515 file802
file1089 file1376 file1663 file1950 file2237 file2524 file516 file803
file109 file1377 file1664 file1951 file2238 file2525 file517 file804
file1090 file1378 file1665 file1952 file2239 file2526 file518 file805
file1091 file1379 file1666 file1953 file224 file2527 file519 file806
file1092 file138 file1667 file1954 file2240 file2528 file52 file807
file1093 file1380 file1668 file1955 file2241 file2529 file520 file808
file1094 file1381 file1669 file1956 file2242 file253 file521 file809
file1095 file1382 file167 file1957 file2243 file2530 file522 file81
file1096 file1383 file1670 file1958 file2244 file2531 file523 file810
file1097 file1384 file1671 file1959 file2245 file2532 file524 file811
file1098 file1385 file1672 file196 file2246 file2533 file525 file812
file1099 file1386 file1673 file1960 file2247 file2534 file526 file813
file11 file1387 file1674 file1961 file2248 file2535 file527 file814
file110 file1388 file1675 file1962 file2249 file2536 file528 file815
file1100 file1389 file1676 file1963 file225 file2537 file529 file816
file1101 file139 file1677 file1964 file2250 file2538 file53 file817
file1102 file1390 file1678 file1965 file2251 file2539 file530 file818
file1103 file1391 file1679 file1966 file2252 file254 file531 file819
file1104 file1392 file168 file1967 file2253 file2540 file532 file82
file1105 file1393 file1680 file1968 file2254 file2541 file533 file820
file1106 file1394 file1681 file1969 file2255 file2542 file534 file821
file1107 file1395 file1682 file197 file2256 file2543 file535 file822
file1108 file1396 file1683 file1970 file2257 file2544 file536 file823
file1109 file1397 file1684 file1971 file2258 file2545 file537 file824
file111 file1398 file1685 file1972 file2259 file2546 file538 file825
file1110 file1399 file1686 file1973 file226 file2547 file539 file826
file1111 file14 file1687 file1974 file2260 file2548 file54 file827
file1112 file140 file1688 file1975 file2261 file2549 file540 file828
file1113 file1400 file1689 file1976 file2262 file255 file541 file829
file1114 file1401 file169 file1977 file2263 file2550 file542 file83
file1115 file1402 file1690 file1978 file2264 file256 file543 file830
file1116 file1403 file1691 file1979 file2265 file257 file544 file831
file1117 file1404 file1692 file198 file2266 file258 file545 file832
file1118 file1405 file1693 file1980 file2267 file259 file546 file833
file1119 file1406 file1694 file1981 file2268 file26 file547 file834
file112 file1407 file1695 file1982 file2269 file260 file548 file835
file1120 file1408 file1696 file1983 file227 file261 file549 file836
file1121 file1409 file1697 file1984 file2270 file262 file55 file837
file1122 file141 file1698 file1985 file2271 file263 file550 file838
file1123 file1410 file1699 file1986 file2272 file264 file551 file839
file1124 file1411 file17 file1987 file2273 file265 file552 file84
file1125 file1412 file170 file1988 file2274 file266 file553 file840
file1126 file1413 file1700 file1989 file2275 file267 file554 file841
file1127 file1414 file1701 file199 file2276 file268 file555 file842
file1128 file1415 file1702 file1990 file2277 file269 file556 file843
file1129 file1416 file1703 file1991 file2278 file27 file557 file844
file113 file1417 file1704 file1992 file2279 file270 file558 file845
file1130 file1418 file1705 file1993 file228 file271 file559 file846
file1131 file1419 file1706 file1994 file2280 file272 file56 file847
file1132 file142 file1707 file1995 file2281 file273 file560 file848
file1133 file1420 file1708 file1996 file2282 file274 file561 file849
file1134 file1421 file1709 file1997 file2283 file275 file562 file85
file1135 file1422 file171 file1998 file2284 file276 file563 file850
file1136 file1423 file1710 file1999 file2285 file277 file564 file851
file1137 file1424 file1711 file2 file2286 file278 file565 file852
file1138 file1425 file1712 file20 file2287 file279 file566 file853
file1139 file1426 file1713 file200 file2288 file28 file567 file854
file114 file1427 file1714 file2000 file2289 file280 file568 file855
file1140 file1428 file1715 file2001 file229 file281 file569 file856
file1141 file1429 file1716 file2002 file2290 file282 file57 file857
file1142 file143 file1717 file2003 file2291 file283 file570 file858
file1143 file1430 file1718 file2004 file2292 file284 file571 file859
file1144 file1431 file1719 file2005 file2293 file285 file572 file86
file1145 file1432 file172 file2006 file2294 file286 file573 file860
file1146 file1433 file1720 file2007 file2295 file287 file574 file861
file1147 file1434 file1721 file2008 file2296 file288 file575 file862
file1148 file1435 file1722 file2009 file2297 file289 file576 file863
file1149 file1436 file1723 file201 file2298 file29 file577 file864
file115 file1437 file1724 file2010 file2299 file290 file578 file865
file1150 file1438 file1725 file2011 file23 file291 file579 file866
file1151 file1439 file1726 file2012 file230 file292 file58 file867
file1152 file144 file1727 file2013 file2300 file293 file580 file868
file1153 file1440 file1728 file2014 file2301 file294 file581 file869
file1154 file1441 file1729 file2015 file2302 file295 file582 file87
file1155 file1442 file173 file2016 file2303 file296 file583 file870
file1156 file1443 file1730 file2017 file2304 file297 file584 file871
file1157 file1444 file1731 file2018 file2305 file298 file585 file872
file1158 file1445 file1732 file2019 file2306 file299 file586 file873
file1159 file1446 file1733 file202 file2307 file3 file587 file874
file116 file1447 file1734 file2020 file2308 file30 file588 file875
file1160 file1448 file1735 file2021 file2309 file300 file589 file876
file1161 file1449 file1736 file2022 file231 file301 file59 file877
file1162 file145 file1737 file2023 file2310 file302 file590 file878
file1163 file1450 file1738 file2024 file2311 file303 file591 file879
file1164 file1451 file1739 file2025 file2312 file304 file592 file88
file1165 file1452 file174 file2026 file2313 file305 file593 file880
file1166 file1453 file1740 file2027 file2314 file306 file594 file881
file1167 file1454 file1741 file2028 file2315 file307 file595 file882
file1168 file1455 file1742 file2029 file2316 file308 file596 file883
file1169 file1456 file1743 file203 file2317 file309 file597 file884
file117 file1457 file1744 file2030 file2318 file31 file598 file885
file1170 file1458 file1745 file2031 file2319 file310 file599 file886
file1171 file1459 file1746 file2032 file232 file311 file6 file887
file1172 file146 file1747 file2033 file2320 file312 file60 file888
file1173 file1460 file1748 file2034 file2321 file313 file600 file889
file1174 file1461 file1749 file2035 file2322 file314 file601 file89
file1175 file1462 file175 file2036 file2323 file315 file602 file890
file1176 file1463 file1750 file2037 file2324 file316 file603 file891
file1177 file1464 file1751 file2038 file2325 file317 file604 file892
file1178 file1465 file1752 file2039 file2326 file318 file605 file893
file1179 file1466 file1753 file204 file2327 file319 file606 file894
file118 file1467 file1754 file2040 file2328 file32 file607 file895
file1180 file1468 file1755 file2041 file2329 file320 file608 file896
file1181 file1469 file1756 file2042 file233 file321 file609 file897
file1182 file147 file1757 file2043 file2330 file322 file61 file898
file1183 file1470 file1758 file2044 file2331 file323 file610 file899
file1184 file1471 file1759 file2045 file2332 file324 file611 file9
file1185 file1472 file176 file2046 file2333 file325 file612 file90
file1186 file1473 file1760 file2047 file2334 file326 file613 file900
file1187 file1474 file1761 file2048 file2335 file327 file614 file901
file1188 file1475 file1762 file2049 file2336 file328 file615 file902
file1189 file1476 file1763 file205 file2337 file329 file616 file903
file119 file1477 file1764 file2050 file2338 file33 file617 file904
file1190 file1478 file1765 file2051 file2339 file330 file618 file905
file1191 file1479 file1766 file2052 file234 file331 file619 file906
file1192 file148 file1767 file2053 file2340 file332 file62 file907
file1193 file1480 file1768 file2054 file2341 file333 file620 file908
file1194 file1481 file1769 file2055 file2342 file334 file621 file909
file1195 file1482 file177 file2056 file2343 file335 file622 file91
file1196 file1483 file1770 file2057 file2344 file336 file623 file910
file1197 file1484 file1771 file2058 file2345 file337 file624 file911
file1198 file1485 file1772 file2059 file2346 file338 file625 file912
file1199 file1486 file1773 file206 file2347 file339 file626 file913
file12 file1487 file1774 file2060 file2348 file34 file627 file914
file120 file1488 file1775 file2061 file2349 file340 file628 file915
file1200 file1489 file1776 file2062 file235 file341 file629 file916
file1201 file149 file1777 file2063 file2350 file342 file63 file917
file1202 file1490 file1778 file2064 file2351 file343 file630 file918
file1203 file1491 file1779 file2065 file2352 file344 file631 file919
file1204 file1492 file178 file2066 file2353 file345 file632 file92
file1205 file1493 file1780 file2067 file2354 file346 file633 file920
file1206 file1494 file1781 file2068 file2355 file347 file634 file921
file1207 file1495 file1782 file2069 file2356 file348 file635 file922
file1208 file1496 file1783 file207 file2357 file349 file636 file923
file1209 file1497 file1784 file2070 file2358 file35 file637 file924
file121 file1498 file1785 file2071 file2359 file350 file638 file925
file1210 file1499 file1786 file2072 file236 file351 file639 file926
file1211 file15 file1787 file2073 file2360 file352 file64 file927
file1212 file150 file1788 file2074 file2361 file353 file640 file928
file1213 file1500 file1789 file2075 file2362 file354 file641 file929
file1214 file1501 file179 file2076 file2363 file355 file642 file93
file1215 file1502 file1790 file2077 file2364 file356 file643 file930
file1216 file1503 file1791 file2078 file2365 file357 file644 file931
file1217 file1504 file1792 file2079 file2366 file358 file645 file932
file1218 file1505 file1793 file208 file2367 file359 file646 file933
file1219 file1506 file1794 file2080 file2368 file36 file647 file934
file122 file1507 file1795 file2081 file2369 file360 file648 file935
file1220 file1508 file1796 file2082 file237 file361 file649 file936
file1221 file1509 file1797 file2083 file2370 file362 file65 file937
file1222 file151 file1798 file2084 file2371 file363 file650 file938
file1223 file1510 file1799 file2085 file2372 file364 file651 file939
file1224 file1511 file18 file2086 file2373 file365 file652 file94
file1225 file1512 file180 file2087 file2374 file366 file653 file940
file1226 file1513 file1800 file2088 file2375 file367 file654 file941
file1227 file1514 file1801 file2089 file2376 file368 file655 file942
file1228 file1515 file1802 file209 file2377 file369 file656 file943
file1229 file1516 file1803 file2090 file2378 file37 file657 file944
file123 file1517 file1804 file2091 file2379 file370 file658 file945
file1230 file1518 file1805 file2092 file238 file371 file659 file946
file1231 file1519 file1806 file2093 file2380 file372 file66 file947
file1232 file152 file1807 file2094 file2381 file373 file660 file948
file1233 file1520 file1808 file2095 file2382 file374 file661 file949
file1234 file1521 file1809 file2096 file2383 file375 file662 file95
file1235 file1522 file181 file2097 file2384 file376 file663 file950
file1236 file1523 file1810 file2098 file2385 file377 file664 file951
file1237 file1524 file1811 file2099 file2386 file378 file665 file952
file1238 file1525 file1812 file21 file2387 file379 file666 file953
file1239 file1526 file1813 file210 file2388 file38 file667 file954
file124 file1527 file1814 file2100 file2389 file380 file668 file955
file1240 file1528 file1815 file2101 file239 file381 file669 file956
file1241 file1529 file1816 file2102 file2390 file382 file67 file957
file1242 file153 file1817 file2103 file2391 file383 file670 file958
file1243 file1530 file1818 file2104 file2392 file384 file671 file959
file1244 file1531 file1819 file2105 file2393 file385 file672 file96
file1245 file1532 file182 file2106 file2394 file386 file673 file960
file1246 file1533 file1820 file2107 file2395 file387 file674 file961
file1247 file1534 file1821 file2108 file2396 file388 file675 file962
file1248 file1535 file1822 file2109 file2397 file389 file676 file963
file1249 file1536 file1823 file211 file2398 file39 file677 file964
file125 file1537 file1824 file2110 file2399 file390 file678 file965
file1250 file1538 file1825 file2111 file24 file391 file679 file966
file1251 file1539 file1826 file2112 file240 file392 file68 file967
file1252 file154 file1827 file2113 file2400 file393 file680 file968
file1253 file1540 file1828 file2114 file2401 file394 file681 file969
file1254 file1541 file1829 file2115 file2402 file395 file682 file97
file1255 file1542 file183 file2116 file2403 file396 file683 file970
file1256 file1543 file1830 file2117 file2404 file397 file684 file971
file1257 file1544 file1831 file2118 file2405 file398 file685 file972
file1258 file1545 file1832 file2119 file2406 file399 file686 file973
file1259 file1546 file1833 file212 file2407 file4 file687 file974
file126 file1547 file1834 file2120 file2408 file40 file688 file975
file1260 file1548 file1835 file2121 file2409 file400 file689 file976
file1261 file1549 file1836 file2122 file241 file401 file69 file977
file1262 file155 file1837 file2123 file2410 file402 file690 file978
file1263 file1550 file1838 file2124 file2411 file403 file691 file979
file1264 file1551 file1839 file2125 file2412 file404 file692 file98
file1265 file1552 file184 file2126 file2413 file405 file693 file980
file1266 file1553 file1840 file2127 file2414 file406 file694 file981
file1267 file1554 file1841 file2128 file2415 file407 file695 file982
file1268 file1555 file1842 file2129 file2416 file408 file696 file983
file1269 file1556 file1843 file213 file2417 file409 file697 file984
file127 file1557 file1844 file2130 file2418 file41 file698 file985
file1270 file1558 file1845 file2131 file2419 file410 file699 file986
file1271 file1559 file1846 file2132 file242 file411 file7 file987
file1272 file156 file1847 file2133 file2420 file412 file70 file988
file1273 file1560 file1848 file2134 file2421 file413 file700 file989
file1274 file1561 file1849 file2135 file2422 file414 file701 file99
file1275 file1562 file185 file2136 file2423 file415 file702 file990
file1276 file1563 file1850 file2137 file2424 file416 file703 file991
file1277 file1564 file1851 file2138 file2425 file417 file704 file992
file1278 file1565 file1852 file2139 file2426 file418 file705 file993
file1279 file1566 file1853 file214 file2427 file419 file706 file994
file128 file1567 file1854 file2140 file2428 file42 file707 file995
file1280 file1568 file1855 file2141 file2429 file420 file708 file996
file1281 file1569 file1856 file2142 file243 file421 file709 file997
file1282 file157 file1857 file2143 file2430 file422 file71 file998
file1283 file1570 file1858 file2144 file2431 file423 file710 file999
file1284 file1571 file1859 file2145 file2432 file424 file711
file1285 file1572 file186 file2146 file2433 file425 file712
[root@localhost lll]# df -i
文件系统 Inode 已用(I) 可用(I) 已用(I)% 挂载点
devtmpfs 478388 431 477957 1% /dev
tmpfs 482657 1 482656 1% /dev/shm
tmpfs 482657 1464 481193 1% /run
tmpfs 482657 16 482641 1% /sys/fs/cgroup
/dev/mapper/centos-root 13629440 160960 13468480 2% /
/dev/sda1 524288 341 523947 1% /boot
tmpfs 482657 1 482656 1% /run/user/0
tmpfs 482657 9 482648 1% /run/user/42
/dev/sdc1 2560 2560 0 100% /lll
磁盘有空间，但是仍然无法写入新文件的可能原因如下所示：
（1）inode号被占满；
（2）磁盘出现问题的情况又分为：磁盘坏道和文件系统出现问题
实验2EXT类型文件恢复
（1）使用fdisk创建分区/dev/sdd1，格式化ext3文件系统;
实验三
XFS类型文件恢复
（1）使用fdisk创建分区/dev/sdb1，格式化xfs文件系统；
[root@localhost ~]# fdisk /dev/sdb
欢迎使用 fdisk (util-linux 2.23.2)。更改将停留在内存中，直到您决定将更改写入磁盘。
使用写入命令前请三思。Device does not contain a recognized partition table
使用磁盘标识符 0x0fa9c7f3 创建新的 DOS 磁盘标签。命令(输入 m 获取帮助)：n
Partition type:p primary (0 primary, 0 extended, 4 free)e extended
Select (default p):
Using default response p
分区号 (1-4，默认 1)：
起始 扇区 (2048-20971519，默认为 2048)：
将使用默认值 2048
Last 扇区, +扇区 or +size{K,M,G} (2048-20971519，默认为 20971519)：
将使用默认值 20971519
分区 1 已设置为 Linux 类型，大小设为 10 GiB命令(输入 m 获取帮助)：t
已选择分区 1
Hex 代码(输入 L 列出所有代码)：8e
已将分区“Linux”的类型更改为“Linux LVM”命令(输入 m 获取帮助)：w
The partition table has been altered!Calling ioctl() to re-read partition table.
正在同步磁盘。
[root@localhost ~]# mkfs -t xfs /dev/sdb1
meta-data=/dev/sdb1 isize=512 agcount=4, agsize=655296 blks= sectsz=512 attr=2, projid32bit=1= crc=1 finobt=0, sparse=0
data = bsize=4096 blocks=2621184, imaxpct=25= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0 ftype=1
log =internal log bsize=4096 blocks=2560, version=2= sectsz=512 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0
[root@localhost ~]# mkdir /lll
[root@localhost ~]# mount /dev/sdb1 /lll
[root@localhost ~]# df -h
文件系统 容量 已用 可用 已用% 挂载点
devtmpfs 1.9G 0 1.9G 0% /dev
tmpfs 1.9G 0 1.9G 0% /dev/shm
tmpfs 1.9G 13M 1.9G 1% /run
tmpfs 1.9G 0 1.9G 0% /sys/fs/cgroup
/dev/mapper/centos-root 26G 5.2G 21G 20% /
/dev/sda1 1014M 187M 828M 19% /boot
tmpfs 378M 0 378M 0% /run/user/0
tmpfs 378M 8.0K 378M 1% /run/user/42
/dev/sdb1 10G 33M 10G 1% /lll
（2）使用xfsdump 命令备份整个分区；
[root@localhost ~]# cp /etc/passwd /etc/shadow /lll/
[root@localhost ~]# echo a > a
[root@localhost ~]# echo b > b
[root@localhost ~]# echo c > c
[root@localhost ~]# ls
a anaconda-ks.cfg b c initial-setup-ks.cfg 公共 模板 视频 图片 文档 下载 音乐 桌面
[root@localhost ~]# cd /lll
[root@localhost lll]# ls
passwd shadow
[root@localhost lll]# cp /etc/passwd /etc/shadow /lll/
cp：是否覆盖"/lll/passwd"？ no
cp：是否覆盖"/lll/shadow"？ n'
[root@localhost lll]# echo c > c
[root@localhost lll]# cp /etc/passwd /etc/shadow /lll/
cp：是否覆盖"/lll/passwd"？ n
cp：是否覆盖"/lll/shadow"？ n
[root@localhost lll]# echo b > b
[root@localhost lll]# echo a > a
[root@localhost lll]# ls
a b c passwd shadow
[root@localhost lll]# mkdir 123
[root@localhost lll]# cp /etc/yum.repos.d/* 123/ -r
[root@localhost lll]# ls -R
.:
123 a b c passwd shadow./123:
local.repo repo.bak./123/repo.bak:
CentOS-Base.repo CentOS-Debuginfo.repo CentOS-Media.repo CentOS-Vault.repo
CentOS-CR.repo CentOS-fasttrack.repo CentOS-Sources.repo CentOS-x86_64-kernel.repo
[root@localhost lll]# cd /opt/
[root@localhost opt]# rpm -q xfsdump
xfsdump-3.1.7-1.el7.x86_64
[root@localhost opt]# xfsdump -f /opt/dump_sdb1 /dev/sdb1
xfsdump: using file dump (drive_simple) strategy
xfsdump: version 3.1.7 (dump format 3.0) - type ^C for status and control============================= dump label dialog ==============================please enter label for this dump session (timeout in 300 sec)-> dump_sdb1
session label entered: "dump_sdb1"--------------------------------- end dialog ---------------------------------xfsdump: level 0 dump of localhost.localdomain:/lll
xfsdump: dump date: Fri Apr 26 14:11:44 2024
xfsdump: session id: 93c072f9-8ebc-4b9d-8da8-bc6a3385f526
xfsdump: session label: "dump_sdb1"
xfsdump: ino map phase 1: constructing initial dump list
xfsdump: ino map phase 2: skipping (no pruning necessary)
xfsdump: ino map phase 3: skipping (only one dump stream)
xfsdump: ino map construction complete
xfsdump: estimated dump size: 91456 bytes
xfsdump: /var/lib/xfsdump/inventory created============================= media label dialog =============================please enter label for media in drive 0 (timeout in 300 sec)-> /dev/sdb1
media label entered: "/dev/sdb1"--------------------------------- end dialog ---------------------------------xfsdump: creating dump session media file 0 (media 0, file 0)
xfsdump: dumping ino map
xfsdump: dumping directories
xfsdump: dumping non-directory files
xfsdump: ending media file
xfsdump: media file size 50160 bytes
xfsdump: dump size (non-dir files) : 24000 bytes
xfsdump: dump complete: 25 seconds elapsed
xfsdump: Dump Summary:
xfsdump: stream 0 /opt/dump_sdb1 OK (success)
xfsdump: Dump Status: SUCCESS
[root@localhost opt]# ls
dump_sdb1 rh
[root@localhost opt]# cd /data/
-bash: cd: /data/: 没有那个文件或目录
[root@localhost opt]# cd /lll/
[root@localhost lll]# ls
123 a b c passwd shadow
[root@localhost lll]# rm -rf *
[root@localhost lll]# ls
[root@localhost lll]# cd /opt
[root@localhost opt]# ls
dump_sdb1 rh
（3）模拟数据丢失并使用 xfsrestore 命令恢复文件；
[root@localhost opt]# cd /lll/
[root@localhost lll]# ls
123 a b c passwd shadow
[root@localhost lll]# rm -rf *
[root@localhost lll]# ls
[root@localhost lll]# cd /opt
[root@localhost opt]# ls
dump_sdb1 rh
四.日志文件
日志的功能
- 用于记录系统、程序运行中发生的各种事件
- 通过阅读日志，有助于诊断和解决系统故障
日志文件的分类
- 内核及系统日志
- 日志格式基本相似由系统服务rsyslog统一进行管理,日志格式基本相似
- 主配置文件/etc/rsyslog.conf
用户日志
- 记录系统用户登录及退出系统的相关信息
程序日志
- 由各种应用程序独立管理的日志文件，记录格式不统一
日志保存位置
- 默认位于:/ar/log目录下
主要日志文件介绍
/var/log/messages:记录linux内核消息及名种应用程序的公共日志信息，包括启动、IO错误、网络错误、程序故障等，对于未使用独立日志文件的应用程序或服务，一般都可以从该日志文中获得相关的事件记录信息。
/var/log/cron:记录crond计划任务产生的事件信息。
/var/log/dmesg:记录linux系统在引导过程中的各种事件信息。
/var/log/maillog:记录进入或发出系统的电子邮件活动。
/var/log/lastlog:记录每个用户最近的登录事件。
/var/log/rpmpkgs:记录系统中安装的各rpm包列表信息。
/var/log/secure:记录用户认证相关的安全事件信息。
/var/log/wtmp:记录每个用户登录、注销及系统启动和停机事件。
/var/run/btmp：记录失败的、错误的登录尝试及验证事件。
内核及系统日志
日志消息的级别
日志记录的一般格式
find [目录名] -mtime +30：查询指定目录下30天以前的文件和目录；
[root@localhost lll]# find /var/log/ -mtime +30
/var/log/samba/old
/var/log/ppp
/var/log/glusterfs
/var/log/speech-dispatcher
/var/log/chrony
/var/log/pluto/peer
/var/log/ntpstats
/var/log/libvirt/qemu
/var/log/sssd
/var/log/swtpm/libvirt/qemu
/var/log/qemu-ga
/var/log/httpd
