Yesterday I got a message from my collegue. 2 Of our Virtual machines on a vmware ESX 4 server, were not running anymore.
When we tried to reboot the machines. We got a nice error: VMX file not found. After a little research we discovered that almost ALL the files are deleted.
When I watch in the directory i see:
-rw------- 1 root root 145M Dec 22 17:48 Redmine Server-000001-delta.vmdk
-rw------- 1 root root 1009M Dec 22 17:50 Redmine Server-000002-delta.vmdk
-rw------- 1 root root 5.2G Jan 5 03:30 Redmine Server-000003-delta.vmdk
-rw------- 1 root root 593M Jan 11 11:42 Redmine Server-000004-delta.vmdk
-rw------- 1 root root 10G Dec 22 17:47 Redmine Server-flat.vmdk
-rw-r--r-- 1 root root 0 Jan 11 11:42 Redmine Server.vmsd
So there are many files missing. But it seems that the data is still there.
Is there ANY way that I can mount these Delta files? I hope someone can help me :smileyplain:
Check these blogs out it might help you.
OK, it looks like someone has been trying to delete files from the datastore, as only the files that are locked are still present.
You can recreate the .vmdk descriptor files by hand, but its not an easy task and especially becasue you have 4 snapshots.
You definitely must have a look at Ulli Hankeln's site www.sanbarrow.com
He's the vmdk expert.
The problem is that since you don't have the .vmdk descriptor files, you don't know your snapshots CID chain. Was 000002-delta linked to 000001-delta or linked to the base disk (-flat). The same is applicable to the other delta files. If you are sure that there hasn't been a "Revert to Snapshot" operation since Dec 22, 17:47 you can link all deltas to eachother in the order 4-3-2-1-flat (based on the last modified date).
If you are not sure, the only safe way is to link delta-000001 to the flat file, but you'll loose all changes since Dec 22, 17:50
Thank you for the usefull comments.
I know that every snapshot is linked to the previous one: 4-3-2-1-flat.
I'm now busy following this blog:
Lets hope that this will work
Welcome to the Community,
if you haven't done this before please be very careful!
If you like to have help, please create a new dummy VM (e.g. named "X-Redmine Server") with a 10G virtual disk (same format and virtual disk controller as the original one) and create 4 snapshots on it. Then attach the 5 header vmdk files (not the flat and/or delta vmdk files) as well as the vmsd file to your next post. I will then modify the files accordingly. After you copy the new files to the old datastore, we should create a clone of the current virtual disk (including the snapshots) to make sure the current files are not going to be modified. Then create a new VM and attach that cloned virtual disk to see whether everything is ok.
IT WORKS AGAIN!
Really thank you guys for the advice :smileylaugh:
What I have done:
- I made a new VM almost identicaly to the original one.
- I took 4 snapshots of the machine.
- Replaced all 4 000X-delta.vdmk files with the ones of the original machine.
- Fortanaly I didn't thin located my VM.
- I manual made a new VMDK Delta and header file with the command:
vmkfstools -c 10737418240 -a lsilogic tmp.vmdk
10737418240 is (in bits) the size of my Virtual HD. This is the size of my original FLAT.vmdk file.
This create a VMDK file (useless, delete it) and a VMDK header file (which you want)
-edit tmp.vmdk (=the header file) and copy the following code:
ddb.virtualHWVersion = "7"
ddb.longContentID = "9841b78aa0068846dfb7aa30fffffffe"
ddb.uuid = "60 00 C2 9b 98 13 b6 9f-1a 9f b4 79 e0 7b f6 db"
ddb.geometry.cylinders = "1305"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.adapterType = "lsilogic"
And pasted in MY VMDK file. Overwrite the standard lines.
- Change de RW value to '20971520' in every vmdk header file. This value comes from the tmp.vmdk.
- Edit the CID and PARENTID of every vmdk header file. So the hang toghetter as a chain.
Run the machine and profit :smileygrin:
More info about creating a VMDK file:
Thank you really :smileygrin:
Glad to hear everything has worked out well.
Now find out who tried to delete your VMs and let him pay your next dinner
Sent from my iPad