Now, with the advent of virtualization technology, many enterprises are starting to use virtualization technology. The principle of virtualization technology is to virtualize the hardware to different virtual machines. That is, a physical machine can have more than one virtual machine. However, if the physical machine fails or the storage server fails, the upper-level virtual machine is unavailable. There are other reasons, including the wrong operation of the employee. This can lead to the loss of important data inside the virtual machine, and the only way to make up for that data is to recover the data. What we're going to talk about today is a case of data recovery with VMware virtualization misoperation.
·
"Virtualized Environment description"
1) The fault virtual machine is migrated from the physical machine to the exsi, and after the migration is completed, a snapshot is made to prevent instability.
2) The virtual machine is running a SQL 2005 database that records all data from 2008 to 2014.
3) There are 20 virtual machines on the entire exsi, Exsi connected storage is an HP EVA4400, and all virtual machines (including failed virtual machines) are placed on Eva.
·
"Virtual Machine Fault description"
The snapshot was accidentally restored due to an employee's mis-operation. The snapshot was built 3 years ago when the migration was completed, that is, the virtual machine was restored to 3 years ago. This means that 3 years of data have been deleted, and this data is of particular importance.
·
"Data Recovery readiness"
Restoring a snapshot is equivalent to deleting the data, which means that the underlying storage space is partially freed. To keep this part of the space from being reused, you need to turn off all virtual machines that are connected to this store, and if you have important virtual machines that cannot be down for a long time, you need to migrate to another exsi. And customers here have a virtual machine is very important, can not shut down, can only do hot migration. The thermal migration of VMware requires more than n snapshots to complete the migration, which brings a lot of trouble to the later recovery snapshot work. After migrating all virtual machines, the underlying EVA storage needs to be mirrored, but the customer is anxious that mirroring the entire storage takes too long. Finally, the EVA storage is mounted to a server in a read-only manner, and we recover the data in a read-only manner.
·
"Data Recovery Scenarios"
Vmfs File System Description:
VMware's own file system is called VMFS, and all virtual machines are stored in this file system. The Vmfs file system, by default, divides the entire disk into a block of 1M, and the smallest unit allocated to the file is a block. There will be an area in the Vmfs file system that describes the usage of these 1M blocks, and each 1024 block (i.e. 1GB) is recorded with a map. The 1M block recorded in this map is not necessarily contiguous on the physical disk. But all 1M blocks recorded by this map must be of the same file. It can be understood that a file consists of 1024 blocks of n multiple maps, that is, FileSize = n
MAP(Block).
·
A snapshot of VMware is actually a file, and restoring a snapshot means deleting a file. In a Vmfs file system, deleting a file deletes only the index entry of the file, not the actual data of the file and the map pointing to the data. All we have to do is extract the free map from the entire VMFS file system and find a map in the free map that matches the header structure of the snapshot file. The remaining fragments of the snapshot file are then extracted based on the structure of the snapshot file. After extracting the snapshot file, you need to merge the snapshot file with the original VMDK to generate a new vmdk. All the data is included in the new VMDK, and the data in the new VMDK interpretation is then mounted.
·
"Data recovery succeeded"
A few fragments of the snapshot were reused due to the client doing an overheated migration of the virtual machine. The latest data is not available in the final recovered data. But since the customer's data is a database and backed up 2 times a day, the latest data is unavailable, but the backed up data is available, and the customer accepts the results of the recovery. The entire recovery process takes 2 days, including verifying the work of the database.
VMware Data Recovery EXSI5.5 virtual machine Restore Snapshot data recovery method
