Can't capture image from Havoc PC
-
@chief-0 OK I found where that code is failing in the script.
Then it calls two functions
runPartprobe "$hd" getPartitions "$hd"Ok for this next bit instead of using pictures lets setup a debugging session to the target computer so you can use the copy and paste function.
This is to be done on the target computer. Get the IP address of the computer with
ip a sand then set root’s password to something simple like hello with the commandpasswddon’t worry the next reboot will reset things in the fos linux system. Now that you have the ip address and root’s password you can login to the fos linux engine using putty or ssh from a windowed system. login as root and the password you set from before. You can do this from the same computer you are interacting with this post. Now you can use cut and paste the commands.Back on point lets see which one of these commands are failing us.
Lets rerun the
lsblkcommand again so you can capture it with cut and paste.Now lets see which of these commands is stopping imaging.
This is from the partprobe code
umount /ntfs /bcdstore udevadm settle blockdev --rereadpt /dev/sdaThis is from the getPartitions (where I expect it to fail)
(lsblk -I 3,8,9,179,202,253,259 -lpno KNAME,TYPE /dev/sda | awk '{if ($2 ~ /part/ || $2 ~ /md/) print $1}' | sort -V | uniq)If that didn’t give you any results lets shorten it to the action part of the command.
lsblk -I 3,8,9,179,202,253,259 -lpno KNAME,TYPE /dev/sdaFrom that output lets see what’s up.
-
@george1421 ok here’s the results of that command
-
@chief-0 Well I kind of wanted you to use the putty copy and paste route to ensure everything was keyed in exactly as it appeared in the script. So please do so.
There are actually two sections of commands the one with the blockdev command and the other that is really long. At least from what you keyed in the long command should give a list of partitions /dev/sda1 to /dev/sda4. So basically you should not have this error (from what I can see here).
-
From putty I ran the command you expected to fail and received the following response.
/dev/sda1
/dev/sda2
/dev/sda3
/dev/sda4 -
@chief-0 I have to be missing something here. I’m just restating this to help me think out loud.
This is the section of code that is printing failed
dots "Reading Partition Tables" if [[ $imgType == "dd" ]]; then echo "Skipped" else runPartprobe "$hd" getPartitions "$hd" if [[ -z $parts ]]; then echo "Failed" debugPause handleError "Could not find partitions ($0)\n Args Passed: $*" fi echo "Done" fiIn the screen shot of the debug deployment we can see it printing “Reading Partition Tables…Failed” That is coming from
dots "Reading Partition Tables" ... echo "Failed"It prints failed when $parts is empty.
if [[ -z $parts ]]; thenYou just manually ran the command that fills the variable $parts
parts=$(lsblk -I 3,8,9,179,202,253,259 -lpno KNAME,TYPE $disk | awk '{if ($2 ~ /part/ || $2 ~ /md/) print $1}' | sort -V | uniq)And it returned
/dev/sda1 /dev/sda2 /dev/sda3 /dev/sda4Which is surely not empty. It should have not printed Failed.
This computer only has one hard drive, right?
In the host definition there is nothing entered into the Primary Disk field?As far as I can tell, it should be working.
-
No sir this machine has 2 separate hard drives according to disk management but there is nothing currently entered into the Host Primary Disk field.
-
@chief-0 said in Can't capture image from Havoc PC:
No sir this machine has 2 separate hard drives according to disk management
Oh wait, what do you mean it has two disks? Doesn’t the original tiny pict of the the lsblk command only show /dev/sda (as I said it is impossible to read it once you zoom in)? If not, that probably the root of the issue and could have saved us a bunch of extra work. Depending on the discovery order it may detect that other disk first.
Using putty what is the output of the lsblk command like I just recently asked for?
If there is a second disk with no partitions, then back in the web ui in the host definition for this computer, add in
/dev/sdaunder the primary disk field save it and try the capture once again. -
Good morning, I apologize for just getting back our afternoon got crazy. Below I have listed the results of the lsblk command from putty.
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 1 931.5G 0 disk
|-sda1 8:1 1 499M 0 part
|-sda2 8:2 1 100M 0 part
|-sda3 8:3 1 16M 0 part
`-sda4 8:4 1 89.5G 0 part
nvme0n1 259:0 0 238.5G 0 diskI did add /dev/sda to the primary disk field and attempted a capture task. Spread out in seemingly random positioning was the following
Out of memory: Killed process 2885 (zstdmt) total-vm:13327152kB, anon-rss: 5775672kb, file-rss:0kb, shmem-rss:0kb, UID:0 pgtables:11444kB oom_score_adj:0
/usr/share/fog/lib/funcs.sh: lin3 2077: 2885 Killed
zstdnt --rsyncable --ultra $PIGZ_COMP < $rifo > ${file}.000
Init Version : 20200906
Failed to complete capture (savePartition)
Args Passed: /dev/sda4 1 /images/7085c2fe0feb all
CMD: partclone.ntfs -n “Storage Location “insert ip address”:/images/dev/, Image name Havoc” -cs -0 /tmp/pigz1 -Nf 1 -a0
Exit Code: 141
Thank you so much for your assistance in this matter our office is currently scratching our heads with this one.
-
@chief-0 said in Can't capture image from Havoc PC:
nvme0n1 259:0 0 238.5G 0 disk
Ok with that info the initial error is perfectly understandable. The nvme drive (which was selected by discovery order, was selected as the boot drive and it has no partitions.
Forcing the system to use /dev/sda then is the right answer. This second problem is a bit interesting in that I haven’t seen this before (or don’t recall seeing it). So this is just a guess. But in the FOG Web UI -> FOG Configuration -> FOG Settings hit the expand all button then search the page for KERNEL RAMDISK SIZE is it still set to 127000 or is it listed at 256000 or larger? This parameter set the FOS Linux’s virtual hard drive size, its possible with a 127MB VHD its too small to buffer that 90GB 4th partition. The default value was changed from 127000 to 256000 several versions back of FOG. If the value is current 256000, lets up it a little to 275000 and see if that’s better,
There is also another field that might need to be bumped up. Its something like capture percent size but a truncated name. Its default if 5 % free, bump that value up to 10% free space. This will leave 10% of the storage space free when shrinking the disk image before capture. That might solve this problem but it will address other issues.
-
Thank you for the info. I just bumped the Capture percent size to 10% however our Kernel RAMDISK Size is already set to 275000. Working for a school district on rare occasions we follow the students schedule so I am leaving work shortly but will return to this forum to continue working on this issue on Tuesday.
Thank you so much!
-
Good morning George we are back at work. Please let me know if you have any other recommendations for us to try with this machine. Thank you!
-
@chief-0 I have not personally see this error before so I can only guess at a direction.
In the image definition, I see from the error message you are using zstd compression (best choice), what is the compression number you have defined? Compression # of 11 is a good balance between speed and compression. Setting this value too high might cause an out of memory condition because zstd needs to look at larger chunks of the file to see where it can find duplicates to compress.
-
@george1421 That worked thanks so much for you time and effort in resolving this issues.
-
@chief-0 said in Can't capture image from Havoc PC:
That worked
“That” being reducing your compression ratio? If yes what did you have it set at so if others run into the issue they can find a solution here.
-
The compression ratio was set to 6 changed it to 11 and everything is working great. Thanks again for your help, we would still be struggling without it.
