Can I safely exclude "/run", "/var" from full backup list?

kaza · 02-09-2019, 03:32 AM

Hello,

I'm currently going over "tar" messages like: "Mod time differs"
or "Contents differ" or "Size differs" created after running
a full backup to tape followed by comparing of the backed up files
with them on the disk.

Many of the differences (I'm only at the begining of the log file)
are in "/run" or "/var" directories. Searching info about
particular files for which the "tar" found differences I see tnat
they're created by the OS so I can excude them from the full backup
list. It would be easier if I just excluded the entire "/run" and "/var"
directories but I hesitate: what if by doing this I'll not backup
something important and if (God forbid) I'll have to recreate my whole system
some missing file from these directories will make the entire restored system
unusable?

Can I safely exclude "/run" and "/var" directories from the full backup list?

If yes, what would be better: to exclude the entire directory like "/run" in the
exclude configuration file or rather "everything below that directory" like: "/run/*" ?
The first option will (I think) remove the "run" directory itself while the second
one will re-create it but leave it empty (I think), preventing problems of OS attempting
to write to non-existant "/run" directory.

Are there other directories (except various "cache" which are already excluded) that I can
safely exclude?

TIA,
kaza.

Shadow_7 · 02-09-2019, 04:23 AM

I wouldn't exclude /var/ as logs end up there. And downloaded packages for updates. Plus other annoyances if you end up without it. Putting /var on it's own device and backing it up separately might be a better idea. Seems like /run could be excluded though. It wasn't even a thing a decade-ish ago and probably more of a post boot presence thing like /proc /dev /opt and such. But I guess that depends on the distro these days.

$ man hier

Might help better isolate what's what. Oddly /run isn't even listed on that it seems. I'm pretty sure you could exclude /usr/share/doc/ if you need to save a lot of space. No one reads docs anyway. Or not!

jsbjsb001 · 02-09-2019, 04:26 AM

You need to do basic research before asking questions.

I'd suggest you have a read of this.

It clearly states the following:

Quote:

/run - Run-time variable data: Information about the running system since last boot, e.g., currently logged-in users and running daemons. Files under this directory must be either removed or truncated at the beginning of the boot process; but this is not necessary on systems that provide this directory as a temporary filesystem (tmpfs).

Quote:

/var - Variable files—files whose content is expected to continually change during normal operation of the system—such as logs, spool files, and temporary e-mail files.

So what do you think the answer is?

syg00 · 02-09-2019, 04:36 AM

The short answer is you shouldn't be backing up a running system - especially to a slow device like tape.
I use snapshot to get a consistent point-in-time reference that I can then backup at my leisure. OpenSUSE rely on snapper to do the job, but they allocate a bunch of separate mounts to allow segregation of what needs to be restorable (from a snap) and what doesn't. They used to have an excellent explanation in their admin guide - you'd do well to go read it.

As for the FHS, does anyone actually conform to it ?.

ehartman · 02-09-2019, 05:55 AM

Quote:

Originally Posted by kaza

Can I safely exclude "/run" and "/var" directories from the full backup list?

As others already mentioned: Do NOT exclude /var as i.e. the complete "installed packages database" (like /var/lib/rpm) is located there so a restored system wouldn't be able anymore to update itself.
Directories like /var/run (mostly PID's of running processes) and /var/tmp of course can be excluded.
And, of course, run the backup when the system is not doing anything else (I do it at 4:50, just after all logfiles have been "rotated" at 4:40).

kaza · 02-09-2019, 03:29 PM

Thanks for all the replies, I'll carefully add to the exclude list few directories
where the files seems like "created automatically" but not the entire "/run" or "/var".

Thanks,
kaza.

ondoho · 02-11-2019, 12:16 AM

Quote:

Originally Posted by kaza

I'll carefully add to the exclude list few directories where the files seems like "created automatically" but not the entire "/run" or "/var".

That is not what was recommended.
It was very clearly recommended to NOT exclude /var at all.
And I also don't see any sense in backing up any part of /run.

pan64 · 02-11-2019, 02:40 AM

when you execute the command mount you will see lines like this:

Code:

sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,nosuid,relatime,size=8104532k,nr_inodes=2026133,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,size=1627100k,mode=755)
/dev/mapper/ubuntu--vg-root on / type ext4 (rw,relatime,errors=remount-ro,data=ordered)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)
...

lines beginning with tmpfs should not be saved, /proc, /sys, /dev should not be saved.

tyler2016 · 02-11-2019, 08:05 AM

First, DO NOT exclude all of /var! It has your package manager databases, application data, and log files. If you lose your package manager database, your system won't know what packages are installed and what their state is. If you lose your logs, it could be harder to figure out what happened that is causing you to restore from backup. I would exclude your package manager cache. These directories typically grow to several GB.

Some applications that keep data in /var by default on popular distributions:

Apache HTTPD
PostgreSQL
MySQL/MariaDB
OpenLDAP
Samba

Here are the locations of package manager caches based on OS upstream:

RHEL: /var/cache/yum
Debian: /var/cache/apt
FreeBSD: /var/cache/pkg

I agree with ondoho that it doesn't make any sense to back up run since all that you usually find here are PID files and AF_UNIX socket files that are generated when processes start.