One of the nice features of ZFS is the ability to take file system snapshots, which you can then use to recover perviously deleted data. In recent opensolaris and Nevada builds, there are several auto-snapshot services that can be used to schedule hourly, daily, weekly and monthly snapshots:
$ svcs -a | grep auto-snapshot
disabled 9:28:28 svc:/system/filesystem/zfs/auto-snapshot:frequent
online 9:28:53 svc:/system/filesystem/zfssnap-roleadd:default
online 12:55:54 svc:/system/filesystem/zfs/auto-snapshot:daily
online 12:56:02 svc:/system/filesystem/zfs/auto-snapshot:weekly
online 12:56:11 svc:/system/filesystem/zfs/auto-snapshot:monthly
online 12:58:37 svc:/system/filesystem/zfs/auto-snapshot:hourly
To enable scheduled snapshots (these services are disabled by default), you can enable one or more of these services with svcadm. Once enabled, these services will create a cron entry in the zfssnap users crontab:
$ cat /var/spool/cron/crontabs/zfssnap
0 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 * * /lib/svc/method/zfs-auto-snapshot svc:/system/filesystem/zfs/auto-snapshot:daily
0 0 1,8,15,22,29 * * /lib/svc/method/zfs-auto-snapshot svc:/system/filesystem/zfs/auto-snapshot:weekly
0 0 1 1,2,3,4,5,6,7,8,9,10,11,12 * /lib/svc/method/zfs-auto-snapshot svc:/system/filesystem/zfs/auto-snapshot:monthly
0 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 * * * /lib/svc/method/zfs-auto-snapshot svc:/system/filesystem/zfs/auto-snapshot:hourly
The cron jobs are used to schedule the automated snapshots, and are added and removed when one of the services are enabled or disabled. I’m not entirely clear why the auto-snapshot author didn’t use “*” in the daily and hourly entries, but hopefully there is a good reason.
To view the list of snapshots on a host, you can use the zfs utility:
$ zfs list -r -t snapshot | head -5
NAME USED AVAIL REFER MOUNTPOINT
bits@zfs-auto-snap:daily-2009-06-18-12:55 0 - 34.4K -
bits@zfs-auto-snap:weekly-2009-06-18-12:56 0 - 34.4K -
bits@zfs-auto-snap:monthly-2009-06-18-12:56 0 - 34.4K -
bits@zfs-auto-snap:daily-2009-06-19-00:00 0 - 34.4K -
If you need to recover a file that was previously deleted, you can cd into the “.zfs/snapshot” directory in the file system that contained the deleted data:
$ zfs list bits/home
NAME USED AVAIL REFER MOUNTPOINT
bits/home 181K 1.17T 149K /home
$ cd /home/.zfs/snapshot
Locate the correct snapshot to recover the file from with ls:
$ ls -l | tail -5
drwxr-xr-x 3 root root 3 May 19 22:43
zfs-auto-snap:hourly-2009-06-20-09:00
drwxr-xr-x 3 root root 3 May 19 22:43
zfs-auto-snap:hourly-2009-06-20-10:00
drwxr-xr-x 3 root root 3 May 19 22:43
zfs-auto-snap:hourly-2009-06-20-11:00
drwxr-xr-x 3 root root 3 May 19 22:43
zfs-auto-snap:monthly-2009-06-18-12:56
drwxr-xr-x 3 root root 3 May 19 22:43
zfs-auto-snap:weekly-2009-06-18-12:56
And then recover the file with cp (or a restore program):
$ find . -name importantfile
./matty/importantfile
$ cp matty/importantfile /tmp
$ ls -la /tmp/importantfile
-rw-r–r– 1 root root 101186 Jun 20 11:30 /tmp/importantfile
This is pretty sweet, and being able to enable automated snapshots with a couple of svcadm invocations is super convenient!