Analysis and recovery of mistaken deletion of hdfs data

1. Relevant parameters:

1. The core-site.xml file modifies the following configuration items:

Fs.trash.interval 2880 HDFS trash bin setting, which can restore erroneous deletion. The configured value is minutes, and 0 is disabled.

2. Note the following configuration items in the hdfs-default.xml file:

Dfs.ha.log-roll.period 120 EditLog log scrolling frequency (in seconds). Default is two minutes.

Second, the analysis process

1. Find the directory where the editlog log is located

Check the hdfs-site.xml file to find the value of the fs.namenode.name.dir configuration item, such as file:/home/hadoop-2.6.0-cdh6.5.0/dfs/name

In the current file in the / home/hadoop-2.6.0-cdh6.5.0/dfs/name directory, it is the editlog file, as shown below

2. Use the command to view edits_inprogress files

# hdfs oev-I edits_inprogress_0000000000000000023-o edits_inprogress_0000000000000000023.xml

Where-I is the input file name and-o is the need to output the parsed file to the file

After the parsing is complete, just view the edits_inprogress_0000000000000000023.xml file.

3. Open file analysis

Locate the deleted file or folder and search for related items in the edits_inprogress_0000000000000000023.xml file, as follows:

OP_RENAME_OLD 150 / dat / user/root/.Trash/Current/dat 1454315297010 6832d4f9-4fa6-4dbb-89aa-ffaa26109078 6

As you can see, the / dat file in HDFS was moved to the Recycle Bin at 1454315297 time.

4. Restore files

Execute the following command:

# fs-mv / user/root/.Trash/Current/dat / dat

Perform a recovery