Re: file changed as we read it: strange

Stefan G. Weichinger wrote:

Guy Dallaire wrote:

This morning, amanda (2.4.5) told me that some files changed during
the backup. I don't think it actually changed. Why does it mean by
"changed" ? The file in question was not being written to during
amanda's backup of the server, that I am sure of.

I'm suspecting a file "last access time" change. Otherwise, a bug in

tar/amanda ?

If files get changed between estimates and dumping, this message istriggered as well ...


I don't think so.
There is no state saved between estimate and dump.

Gnutar compares ctime of the file and just before closing and if
that has changed, you get the message "file changed as we read it".
Note a ctime change can also result from inode change like chown,
or a forced mtime or atime change (e.g. from an --atime-preserve
option of another tar; tar resets the atime just after this test,
otherwise you'ld get all false alerts).
If you read a block of a file, seek back again to the beginning
of the block, and write the same block again, the ctime changes too;
nevertheless, the contents of the file are still the same.

I'm suspecting something else on the system.  Don't blame it on
bugs in tar when there are people around to blame.
You said it was an oracle datafile.  Are you 100% sure all the
oracle processes stopped, and no process had the file open?

--
Paul Bijnens, Xplanation                            Tel  +32 16 397.511
Technologielaan 21 bus 2, B-3001 Leuven, BELGIUM    Fax  +32 16 397.512
http://www.xplanation.com/          email:  Paul.Bijnens AT xplanation DOT com
***********************************************************************
* I think I've got the hang of it now:  exit, ^D, ^C, ^\, ^Z, ^Q, F6, *
* quit,  ZZ, :q, :q!,  M-Z, ^X^C,  logoff, logout, close, bye,  /bye, *
* stop, end, F3, ~., ^]c, +++ ATH, disconnect, halt,  abort,  hangup, *
* PF4, F20, ^X^X, :D::D, KJOB, F14-f-e, F8-e,  kill -1 $$,  shutdown, *
* init 0, kill -9 1, Alt-F4, Ctrl-Alt-Del, AltGr-NumLock, Stop-A, ... *
* ...  "Are you sure?"  ...   YES   ...   Phew ...   I'm out          *
***********************************************************************