Radified Community Forums | |
http://radified.com/cgi-bin/yabb2/YaBB.pl
Rad Community Technical Discussion Boards (Computer Hardware + PC Software) >> Norton Ghost 2003, Ghost v8.x + Ghost Solution Suite (GSS) Discussion Board >> "Hot Imaging": Managing Disk Activity http://radified.com/cgi-bin/yabb2/YaBB.pl?num=1142203569 Message started by Pleonasm on Mar 12th, 2006 at 4:46pm |
Title: "Hot Imaging": Managing Disk Activity Post by Pleonasm on Mar 12th, 2006 at 4:46pm
Creating a recovery point of a system volume while the operating system is active is known as "hot imaging." But, what is the 'temperature' of a "hot image" – i.e., to what extent are disk write operations occurring during the imaging process?
To answer this question, I ran and logged the output from Filemon for the system partition ('C:') for one hour under conditions of quiescence (i.e., no keyboard or mouse activity, launching no new programs, etc.) with Norton Internet Security 2006 active. An examination of all disk writes revealed the following key observations.
Nonetheless, if a Ghost 10 backup job is started and if the user simply allows the job to run without intervention, then there appears to be little "hot activity" that needs to be monitored and managed by Ghost 10 in order to ensure the consistency of the recovery point. This does not logically prove, of course, that the "hot imaging" process is as inherently reliable as "cold imaging" (e.g., using Ghost 8.2 or Ghost 2003), but it does suggest that the extent of the "hot imaging" problem may be considerably less than had otherwise been expected. I encourage others to repeat the experiment, so that these results can be verified and augmented. |
Title: Re: "Hot Imaging": Managing Disk Activi Post by Ghost4me.John on Mar 12th, 2006 at 6:19pm
I know that hot-imaging has been discussed quite a bit before. Two areas to consider with hot-imaging:
1. Physical i/o or changes that occur during the backup process. You've covered that quite well, and as I understand it, Ghost 10 monitors that case and takes care of it. 2. Memory or buffer changes that may have not yet been written to disk. For example, the messages when shutting down XP, "logging off", "saving changes". Are those changes which presumably are in the memory or the registry on the backup or not? I believe that within limits hot-imaging and Ghost 10 works fine. I'm satisfied with it if used carefully. |
Title: Re: "Hot Imaging": Managing Disk Activi Post by El_Pescador on Mar 12th, 2006 at 6:52pm Pleonasm wrote on Mar 12th, 2006 at 4:46pm:
Long before he even became a Forum member (which required considerable cajoling by others, I might add), I repeatedly promoted Moderator status for the author of this thread. I based my recommendation on his consistently constructive contributions to these boards over time. I am of the opinion that the initial post above certainly vindicates my longstanding advocacy. EP :'( |
Title: Re: "Hot Imaging": Managing Disk Activi Post by Rad on Mar 12th, 2006 at 7:57pm
downloading filemon now. i like utilities like that which let me see what the system is doing.
|
Title: Re: "Hot Imaging": Managing Disk Activi Post by Pleonasm on Mar 13th, 2006 at 12:47pm
Ghost4me, concerning changes to the registry, Sysinternals has a tool called Regmon that monitors real-time registry changes. I did not use Regmon in my ‘experiment,’ only because the creation of a snapshot of the registry seems to be a straightforward process. For example, the VBS command ‘createrestorepoint("Restore Point", 0, 100)’ does the job. The mechanism that Ghost 10 uses to intercept disk writes and suspend their execution until after the recovery point is created would seem to apply equally well to registry changes, since the registry is a disk file, too.
I don’t know how Ghost 10 handles buffered disk writes, but as long as the buffer is not actually flushed to physical disk, then one would anticipate that it would have no impact on the generation of a consistent recovery point. If the buffer is flushed to disk, then it is the same case as if the application did a disk write. One could envision circumstances in which the creation of a “hot image” by Ghost 10 becomes considerably more challenging. In theory, while running a Ghost 10 backup job, a user could launch a disk defragmentation, uninstall one application and install another, run Windows Update, and download files from the Internet. One would expect that at some point (such as in this example) Ghost 10 would become overwhelmed with disk changes and exit with an error condition. This, however, is probably an extreme and unusual case. I suspect that most users launch the Ghost 10 backup job, and walk away from the PC until it is complete – or, schedule the job to run during the evening hours when no one is using the PC anyway. As my experiment illustrated, under these more typical conditions, the creation of a "hot image" doesn’t seem to be considerably more complicated (and therefore more risky) than the case of a “cold image” in which no files on the volume are open. Again, I encourage others to repeat the experiment I described in the initial post on this thread, in order to either confirm or correct the reported findings. El_Pescador, thank you for the kind comments! I am honored to have received the designation of moderator. |
Title: Re: "Hot Imaging": Managing Disk Activi Post by Pleonasm on Jul 28th, 2006 at 1:41pm
The following description of how Acronis True Image creates a ‘hot image’ may be of interest.
Quote:
Source: http://www.acronis.com/enterprise/company/inpress/2003/01-ctr-disk-imaging.html |
Title: Re: "Hot Imaging": Managing Disk Activi Post by NightOwl on Jul 29th, 2006 at 12:29pm
Pleonasm
I think you *hit the nail on the head* with this statement: Quote:
I think anyone who has used prior versions of Windows, i.e. Win9x or ME, or even Win3.1, has had the experience where *multitasking* causes the system to either become unstable or freeze--I suspect this is where a lot of the concern/negative feelings about the concept of *hot imaging* comes from. I have to say the WinXP has been much more stable in this regard than prior versions of Windows! I think it should almost be a recommendation that one not attempt multitasking when doing a complex procedure as *hot imaging* and tempting the *fate gods* to cause your system to *crash and burn*. As you clearly show--the complexity isn't *overwhelming* when the system is merely *idling*--but, I'm sure it gets increasingly complex, especially if a program has HDD intensive activity. |
Title: Re: "Hot Imaging": Managing Disk Activi Post by Pleonasm on Jul 29th, 2006 at 12:49pm
NightOwl, both as a practical matter and simply to be cautious, I agree that doing "heavy multitasking" when creating a Ghost 10 image may be "tempting the Gods of Fate." I can't speak for other users of Ghost 10, but I suspect that most would either schedule a backup job when the PC is idle (e.g., in the evening hours) or simply walk away after starting a backup job and then return when the task is complete.
We do not know that Ghost 10 uses the same approach as that described by Acronis, but it is probably quite similar. I found the 'hot imaging' algorithm to be intellectually elegant – simple, straightforward without convolutions, and apparently bullet-proof. Provided that all I/O by applications on the PC are using Windows APIs (rather than direct-to-disk writes), I can't see how the algorithm would fail to produce a consistent and complete image of a partition at a point in time. |
Title: Re: "Hot Imaging": Managing Disk Activi Post by Pleonasm on Jul 30th, 2006 at 10:31am
The question, "How do you know that a 'hot image' successfully captured the state of the partition at a single and consistent point-in-time?" is an important one, and it speaks to core issue of whether 'hot imaging' is reliable. I have no reason to believe that Ghost 10 is performing the following process, but here is one solution that – if implemented – would answer the question:
|
Title: Re: "Hot Imaging": Managing Disk Activi Post by Pleonasm on Jan 30th, 2007 at 7:16am
Readers of this thread might find the following discussion to be of interest.
Quote:
The author of the above comments is self-described as a “senior engineer focused on enterprise solutions” at StorageCraft. The same author also comments: “StorageCraft's snapshot technology is used by many companies, and in several backup products. It's been around for several years, is deployed on tens of millions of computers, and has matured to {a} very robust state.” I also learned that the driver used by Ghost 10 to perform its “hot imaging” was developed by StorageCraft and is licensed to Symantec. You can verify this fact by examining the properties of C:\WINDOWS\system32\drivers\SymSnap.sys (note the copyright designation). |
Title: Re: "Hot Imaging": Managing Disk Activity Post by Pleonasm on Apr 7th, 2007 at 1:54pm
Readers of this thread who may still have some reluctance to employ a "hot imaging" solution should take comfort in the comments of Nbree, a Ghost developer and Principal Software Engineer at Symantec.
Quote:
Hopefully, the opinion of a Ghost (2003/8.2/Ghost Solution Suite) expert will serve to ameliorate any residual concerns about the use of "hot imaging". |
Radified Community Forums » Powered by YaBB 2.4! YaBB © 2000-2009. All Rights Reserved. |