> On Tue, 15 Nov 2022 09:40:11 -0500 > Dan Ritter <d...@randomstring.org> wrote: > > > rhkra...@gmail.com wrote: > > > I'm not really clear on the concept of a snapshot (for backup) -- > > > I've done a little googling but haven't found an explanation that > > > "satisfies" me. > > > > > > Starting from a beginning, I suppose I could copy the entire > > > contents of whatever I wanted to make a snapshot of (by any of a > > > variety of tools -- dd, cp, ...) and call that a snapshot, > > > although the more common name for it would be a "full backup". > > > > Let's look at the larger circumstances. > > > > In ordinary usage, there are tens to thousands of processes > > runnning on your system. Some of them are emitting logs or > > writing files. > > > > Taking a backup takes some time. During that time, some files > > get written, some get opened, and some are related to each other > > (by the processes) in ways which are inconsistent until all of > > them are written. > > > > A snapshot differs from a backup in two important regards: > > > > - first, it requires the filesystem to bring writes to a halt. > > There is now a consistent view. > > > > - second, it doesn't actually copy things. It just records their > > state and, when done, allows future writes to continue -- writes > > which are not part of this snapshot. > > > > As a result, you can take a snapshot and then: > > > > - discard it (trivial) > > > > - look through it and copy off any file or group of files, thus > > getting what they contained at the time of the snapshot, not the > > what they contain now (excellent for recovering from an > > accidental delete) > > > > - copy all of it off elsewhere, producing a consistent full > > backup. > > > > Assuming a snapshot is taken so that you can recover a filesystem to a > previous state (or the current state). Is that correct? > > I don't understand "recording the state" of files. To me, this means > the ownership, size, etc., not the contents. That doesn't seem > valuable for recovering the state of a system. > > Let's assume, as the OP says, you do an original full backup. A > snapshot ought to record either the contents of all the files which > have changed, or record the delta of each file which has changed. > Thus, you'd be able to recover a filesystem to either some prior state > or its current state, using the snapshot. > > Am I missing something?
I think what you're missing is that 'snapshots' are usually an attribute of a copy-on-write (COW) filesystem such as btrfs or zfs. So a snapshot is a list of the blocks that belong to particular files at some particular moment. Once the snapshot has been taken, the filesystem can resume writes by copying any blocks that need to be written subsequently and updating the current map of which blocks belong to which files, but not touching the snapshot's map. And when looking for empty space on the disk to use, it ignores any block that appears in any map.
