tar - File changed as we read it
 

I was running a tar command on a folder with around 150GB of files. It is a website script and a picture galleries site. The exact command was:

tar -zcf target-file-name.tar.gz /home/www/html/site-folder

I was reading about this error on the Internet and I have a general idea what it is, but I was wondering about two things:

1) What is it that is changing these files or a file? What is it literally on a Centos 7 machine that is doing that? It is a basic installation with httpd, mariadb, php and other things like this that are needed for the serving of sites.

2) How can I stop that.

Find what it is and stop it... How to do that?

Thanks.

chattr +i /path/to/file (makes the file write immutable)

Also maybe this might help: lsof -p pid# | grep log (to see what logs something is writing to; replace log with bin to see where the binary is, or .so to see what shared library something is using)

Install and run audit.

It tracks who or what changes files.

https://www.cyberciti.biz/tips/linux...to-a-file.html

Have you searched through the source folder for all those files modified since you started the tar running? That should help you take the first step and pinpoint which file(s) are being modified, if any. Also check ctime and atime's.

I trust that you're not creating the target archive in the source folder.

Duplicity (the encrypted incremental backup program) can detect changes by comparing the latest backup with your current files.

You are in /home/www/html/site-folder/ when you ran it.

Is it the live folder for your site?

Is it a dynamic website that allows users on the net to make changes? (like uploading files, chat etc.)

No, I was not doing that. I was one directory above that. I actually used the tar command on Windows Cygwin and it worked. I dont have to rsync that data too and my connection speed is not very good (I have a lower plan).

It was taken down from the Internet. The Apache screen was showing for this domain. No entry in /etc/httpd/httpd.conf

when tar drops a message like X file changed, you can use fuser on that file (immediately) to check who is/are opened that.

+1.
cd out of /home/www/html/
run tar.

will show you what's is "open" and using resources in
/home/www/html/site-folder/

If it's a live website, it's probably the active log files that are changing. You can put them in an exclusion file so they are not backed up by tar (you probably don't need them backed up anyway). You can leave archived log files being backed up since they no longer changing, if you have some log rotation script installed (just make sure the rotation doesn't conflict with your backup).

Forums and other stuff is usually saved to a database which should store its files somewhere else and should have its own backup tools.

Thanks for the info. I will be looking into all that later on. As far as that, the site was not live. If it would be live, there are in fact some folders there that constantly change, like caching.