1

Attempting to recover a 5 Disk Raid wherein 2 of the 5 disks are out of sync. Is it safe to create the raid from 4 of the disks?

mdadm --examine /dev/sd*1 > /raid.status 


 grep Role raid.status
   Device Role : Active device 0
   Device Role : Active device 1
   Device Role : Active device 2
   Device Role : Active device 3
   Device Role : Active device 4

    grep 'Array State'  raid.status
   Array State : AAAAA ('A' == active, '.' == missing)
   Array State : .AA.A ('A' == active, '.' == missing)
   Array State : .AA.A ('A' == active, '.' == missing)
   Array State : .AAAA ('A' == active, '.' == missing)
   Array State : .AA.A ('A' == active, '.' == missing)



    mdadm -E /dev/sd*1 | grep Events
mdadm: No md superblock detected on /dev/sda1.
         Events : 968549
         Events : 2062106
         Events : 2062106
         Events : 2062081
         Events : 2062106
JamesCW
  • 309
futurusx
  • 11
  • How'd it get to this state? Yes, you can assemble the array into a degraded state with only 4 disks (keep the first disk out) - but what's going on with the 4th disk in those grep outputs? – Shane Madden Mar 09 '12 at 16:17
  • I'm coming in after the fact. But examining the mdadm -E output looks like the disk with Event - 968549 with Array State (AAAAA) dropped out of the array a month ago. The other disk failed / dropped out on the same day (Event 2062081 ) causing the array to fail. After a reboot all drives are present but out of sync. With the array unable to start. The general consensus after trying to assemble and failing, is to run - mdadm --create /dev/md0 --assume-clean --level=5 - with the drives we trust. But I'm wondering if that's safe with the out of sync Events. – futurusx Mar 09 '12 at 16:29
  • 5
    Do yourself a favor and before doing anything make a clone of each drive. Either to an image or new drives. Then set your original drives aside and do any data recovery attempts using the clones. – 3dinfluence Mar 09 '12 at 16:30
  • 1
    Further advantage of cloning is that it will show if there are any physical problems with the drives. If there are you shouldn't proceed with the original drives, it might destroy even more data. dd_rescue can be used to copy damaged drives. This could take a while for large, damaged drives. – Jasper Mar 09 '12 at 17:06
  • Definitely a good idea. We are running a clone each drive now. – futurusx Mar 09 '12 at 20:55

1 Answers1

3

Disk 4 certainly isn't very far behind.. and really, you don't have a lot to lose at this point.

Your definition of "safe" is important here; is this data backed up? Nothing that you do at this point is guaranteed to be non-destructive -- in fact, any action that you take is guaranteed to be destructive to some data; but hopefully the filesystem's journal can deal with it.

So, proceed with care; if this data is critically important and not backed up anywhere, then stop right now and make dd copies of the disks before doing anything.

That said, you should be able to get the array back up, assuming that the disks still work.

I'm assuming that sda is the disk that's got the much older event number. We want to keep that disk out - so adjust this command if it's not sda (and if your array isn't md0):

mdadm --assemble --force --run /dev/md0 /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde1
Shane Madden
  • 115,228
  • I believe the assemble force was run on the disks that are mostly in sync with a failure. I'm going to try and clone and bring up the clones. The backup status is definitely questionable. – futurusx Mar 09 '12 at 17:20