问题:
如果一个4G的文件,删除开始几个字节,底层磁盘会发生什么变化?
猜想:
在团队的分享讨论中,有人认为会有高效的方式,优化文件修改。让我们用实验测试一下,ext2文件系统具体是怎么执行的。
实践:
1. 采用 linux loop设备作为虚拟磁盘,并mount到一个文件。 磁盘一共1000个block,每个block大小是512。(实践上创建完成之后,发现是500个block,每个block大小是1024,总容量没有变化。)
dd if=/dev/zero of=~/file.img bs=512 count=1000
LOOFDEV=`sudo losetup --find --show ~/file.img`
mkdir file.image.loop -p
sudo mkfs -t ext2 $LOOFDEV
sudo mount $LOOFDEV file.image.loop
获取块大小
BLOCKSIZE=`dumpe2fs ~/file.img | grep "Block size:" | awk '{print $NF}'`
2. 查看文件系统详细信息
dumpe2fs ~/file.img
输入结果如下:
dumpe2fs 1.44.1 (24-Mar-2018)
2 Filesystem volume name: <none>
3 Last mounted on: <not available>
4 Filesystem UUID: 53664a8d-19e9-4cb3-9cd9-6c1c4f5f1598
5 Filesystem magic number: 0xEF53
6 Filesystem revision #: 1 (dynamic)
7 Filesystem features: ext_attr resize_inode dir_index filetype sparse_super large_file
8 Filesystem flags: signed_directory_hash
9 Default mount options: user_xattr acl
10 Filesystem state: not clean
11 Errors behavior: Continue
12 Filesystem OS type: Linux
13 Inode count: 64
14 Block count: 500
15 Reserved block count: 25
16 Free blocks: 472
17 Free inodes: 53
18 First block: 1
19 Block size: 1024
20 Fragment size: 1024
21 Reserved GDT blocks: 1
22 Blocks per group: 8192
23 Fragments per group: 8192
24 Inodes per group: 64
25 Inode blocks per group: 8
26 Filesystem created: Sun May 10 16:29:03 2020
27 Last mount time: Sun May 10 16:29:04 2020
28 Last write time: Sun May 10 16:29:04 2020
29 Mount count: 1
30 Maximum mount count: -1
31 Last checked: Sun May 10 16:29:03 2020
32 Check interval: 0 (<none>)
33 Reserved blocks uid: 0 (user root)
34 Reserved blocks gid: 0 (group root)
35 First inode: 11
36 Inode size: 128
37 Default directory hash: half_md4
38 Directory Hash Seed: 97e7d950-9ee2-405e-9dfa-f36c2ff7baa5
39
40
41 Group 0: (Blocks 1-499)
42 Primary superblock at 1, Group descriptors at 2-2
43 Reserved GDT blocks at 3-3
44 Block bitmap at 4 (+3)
45 Inode bitmap at 5 (+4)
46 Inode table at 6-13 (+5)
47 472 free blocks, 53 free inodes, 2 directories
48 Free blocks: 28-499
49 Free inodes: 12-64
14行显示,有500个块
16行显示,空闲块是472个。
19行显示,每个块大小是1024字节。
3. 创建一个文件,写入3个块(实际是4给块,最后一个块是EOF)
cd file.image.loop/
COUNT=$BLOCKSIZE
python -c "print('a' * $COUNT + 'b' * $COUNT + 'c' * $COUNT)" |sudo tee a.txt
写入1024个字母“a”(HEX 61,DEX97 )
写入10024个字母“b”(HEX 62,DEX98 )
写入10024个字母“b”(HEX 63,DEX99 )
4. 查看文件字节数
ls查看
ls -l a.txt
-rw-r--r-- 1 root root 3073 5月 10 16:42 a.txt
wc点字节数
cat a.txt |wc -c
3073
5. 查看文件的具体信息
sudo debugfs $LOOFDEV <<< "stat a.txt"
输出如下结果:
Inode: 12 Type: regular Mode: 0644 Flags: 0x0
Generation: 2365015721 Version: 0x00000001
User: 0 Group: 0 Size: 3073
File ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x5eb7be5a -- Sun May 10 16:42:02 2020
atime: 0x5eb7bea6 -- Sun May 10 16:43:18 2020
mtime: 0x5eb7be5a -- Sun May 10 16:42:02 2020
BLOCKS:
(0-3):28-31
TOTAL: 4
数据位于28-31的磁盘块中。
获取起始块和长度
BNUM=`sudo debugfs $LOOFDEV <<< "blocks a.txt" |grep -o "^[0-9 ]*" |cut -d " " -f1`
BLEN=`sudo debugfs $LOOFDEV <<< "blocks a.txt" |grep -o "^[0-9 ]*" |wc -w`
6. 查看文件对应的block内容
sudo dd if=$LOOFDEV bs=$BLOCKSIZE count=$BLEN skip=$BNUM | od -t x1 -Ax
输入如下内容
4+0 records in
4+0 records out
4096 bytes (4.1 kB, 4.0 KiB) copied, 8.578e-05 s, 47.8 MB/s
000000 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61
*
000400 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62
*
000800 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63
*
000c00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000c10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
001000
删除四个字符
sudo sed -i -r '1s/.{4}//' a.txt
cat a.txt |wc -c
再次查看文件内容
sudo dd if=$LOOFDEV bs=$BLOCKSIZE count=$BLEN skip=$BNUM | od -t x1 -Ax
没有发生变化,同步数据到磁盘也没有发生变化
sync -f a.txt
这是因为文件的inode和block发生了变化,但是原来存储数据的block并没有擦除。这就是为什么一些磁盘恢复工具能恢复数据的原理。
7. 重新查看文件的具体信息
sudo debugfs $LOOFDEV <<< "stat a.txt"
显示结果如下:
Inode: 13 Type: regular Mode: 0644 Flags: 0x0
Generation: 1601438359 Version: 0x00000001
User: 0 Group: 0 Size: 3069
File ACL: 0
Links: 1 Blockcount: 6
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x5eb7c5b5 -- Sun May 10 17:13:25 2020
atime: 0x5eb7c5b8 -- Sun May 10 17:13:28 2020
mtime: 0x5eb7c5b5 -- Sun May 10 17:13:25 2020
BLOCKS:
(0-2):32-34
TOTAL: 3
我们可以看到block,从前面的28-21移动到了32-34
8. 再次获取新的数据块起始和长度
注意,实际中,数据块不一定是连续的,本实验是因为采用了一个全新的空磁盘。或者再做一次实验,就会发现数据块,可能不连续了。
BNUM=`sudo debugfs $LOOFDEV <<< "blocks a.txt" |grep -o "^[0-9 ]*" |cut -d " " -f1`
BLEN=`sudo debugfs $LOOFDEV <<< "blocks a.txt" |grep -o "^[0-9 ]*" |wc -w`
查看文件对应的block内容
sudo dd if=$LOOFDEV bs=$BLOCKSIZE count=$BLEN skip=$BNUM | od -t x1 -Ax
内容如下,已发生变化
3+0 records in
3+0 records out
3072 bytes (3.1 kB, 3.0 KiB) copied, 0.000226374 s, 13.6 MB/s
000000 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61
*
0003f0 61 61 61 61 61 61 61 61 61 61 61 61 62 62 62 62
000400 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62
*
0007f0 62 62 62 62 62 62 62 62 62 62 62 62 63 63 63 63
000800 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63
*
000bf0 63 63 63 63 63 63 63 63 63 63 63 63 0a 00 00 00
000c00
9. 清理环境
首先查看还有没有进程打开该磁盘,有的话,kill该进程
sudo lsof $LOOFDEV
cd ..
sudo umount $LOOFDEV
sudo losetup -d $LOOFDEV
rm file.img -rf
rm file.image.loop -rf
结论:
整个磁盘都会移动,这其实是最好的方式, 所有数据都是循序读写。
修改一个文件,其实就是创建了一个新文件,inode和磁盘数据都会发生变化。
这是由于文件系统,只提供了read和write的操作,并没有提供插入和删除的操作,其实是应用程序实现了新建文件的操作。
我们可以实现sed过程的strace
sudo strace sed -i -r '1s/.{4}//' a.txt
2 execve("/bin/sed", ["sed", "-i", "-r", "1s/.{4}//", "a.txt"], 0x7ffcf1b4cfe0 /* 24 vars */) = 0
3 brk(NULL) = 0x564cef104000
4 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
5 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
6 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
7 fstat(3, {st_mode=S_IFREG|0644, st_size=167308, ...}) = 0
8 mmap(NULL, 167308, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f9820a7a000
9 close(3) = 0
10 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
11 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
12 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20b\0\0\0\0\0\0"..., 832) = 832
13 fstat(3, {st_mode=S_IFREG|0644, st_size=154832, ...}) = 0
14 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9820a78000
15 mmap(NULL, 2259152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f9820654000
16 mprotect(0x7f9820679000, 2093056, PROT_NONE) = 0
17 mmap(0x7f9820878000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x24000) = 0x7f9820878000
18 mmap(0x7f982087a000, 6352, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f982087a000
19 close(3) = 0
20 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
21 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
22 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\34\2\0\0\0\0\0"..., 832) = 832
23 fstat(3, {st_mode=S_IFREG|0755, st_size=2030544, ...}) = 0
24 mmap(NULL, 4131552, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f9820263000
25 mprotect(0x7f982044a000, 2097152, PROT_NONE) = 0
26 mmap(0x7f982064a000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e7000) = 0x7f982064a000
27 mmap(0x7f9820650000, 15072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9820650000
28 close(3) = 0
29 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
30 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpcre.so.3", O_RDONLY|O_CLOEXEC) = 3
31 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 \25\0\0\0\0\0\0"..., 832) = 832
32 fstat(3, {st_mode=S_IFREG|0644, st_size=464824, ...}) = 0
33 mmap(NULL, 2560264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f981fff1000
34 mprotect(0x7f9820061000, 2097152, PROT_NONE) = 0
35 mmap(0x7f9820261000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x70000) = 0x7f9820261000
36 close(3) = 0
37 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
38 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
39 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\16\0\0\0\0\0\0"..., 832) = 832
40 fstat(3, {st_mode=S_IFREG|0644, st_size=14560, ...}) = 0
41 mmap(NULL, 2109712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f981fded000
42 mprotect(0x7f981fdf0000, 2093056, PROT_NONE) = 0
43 mmap(0x7f981ffef000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f981ffef000
44 close(3) = 0
45 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
46 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
47 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000b\0\0\0\0\0\0"..., 832) = 832
48 fstat(3, {st_mode=S_IFREG|0755, st_size=144976, ...}) = 0
49 mmap(NULL, 2221184, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f981fbce000
50 mprotect(0x7f981fbe8000, 2093056, PROT_NONE) = 0
51 mmap(0x7f981fde7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19000) = 0x7f981fde7000
52 mmap(0x7f981fde9000, 13440, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f981fde9000
53 close(3) = 0
54 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9820a76000
55 arch_prctl(ARCH_SET_FS, 0x7f9820a77040) = 0
56 mprotect(0x7f982064a000, 16384, PROT_READ) = 0
57 mprotect(0x7f981fde7000, 4096, PROT_READ) = 0
58 mprotect(0x7f981ffef000, 4096, PROT_READ) = 0
59 mprotect(0x7f9820261000, 4096, PROT_READ) = 0
60 mprotect(0x7f9820878000, 4096, PROT_READ) = 0
61 mprotect(0x564cee735000, 4096, PROT_READ) = 0
62 mprotect(0x7f9820aa3000, 4096, PROT_READ) = 0
63 munmap(0x7f9820a7a000, 167308) = 0
64 set_tid_address(0x7f9820a77310) = 313
65 set_robust_list(0x7f9820a77320, 24) = 0
66 rt_sigaction(SIGRTMIN, {sa_handler=0x7f981fbd3cb0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f981fbe0890}, NULL, 8) = 0
67 rt_sigaction(SIGRT_1, {sa_handler=0x7f981fbd3d50, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f981fbe0890}, NULL, 8) = 0
68 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
69 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
70 statfs("/sys/fs/selinux", 0x7ffc909bbef0) = -1 ENOENT (No such file or directory)
71 statfs("/selinux", 0x7ffc909bbef0) = -1 ENOENT (No such file or directory)
72 brk(NULL) = 0x564cef104000
73 brk(0x564cef125000) = 0x564cef125000
74 openat(AT_FDCWD, "/proc/filesystems", O_RDONLY|O_CLOEXEC) = 3
75 fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
76 read(3, "nodev\tsysfs\nnodev\trootfs\nnodev\tr"..., 1024) = 477
77 read(3, "", 1024) = 0
78 close(3) = 0
79 access("/etc/selinux/config", F_OK) = -1 ENOENT (No such file or directory)
80 openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
81 fstat(3, {st_mode=S_IFREG|0644, st_size=10281936, ...}) = 0
82 mmap(NULL, 10281936, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f981f1ff000
83 close(3) = 0
84 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/charset.alias", O_RDONLY|O_NOFOLLOW) = -1 ENOENT (No such file or directory)
85 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", O_RDONLY) = 3
86 fstat(3, {st_mode=S_IFREG|0644, st_size=26376, ...}) = 0
87 mmap(NULL, 26376, PROT_READ, MAP_SHARED, 3, 0) = 0x7f9820a9c000
88 close(3) = 0
89 futex(0x7f982064fa08, FUTEX_WAKE_PRIVATE, 2147483647) = 0
90 openat(AT_FDCWD, "a.txt", O_RDONLY) = 3
91 ioctl(3, TCGETS, 0x7ffc909bbcf0) = -1 ENOTTY (Inappropriate ioctl for device)
92 fstat(3, {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
93 umask(0700) = 022
94 getpid() = 313
95 openat(AT_FDCWD, "./sediSJ0Jh", O_RDWR|O_CREAT|O_EXCL, 0600) = 4
96 umask(022) = 0700
97 fcntl(4, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
98 fstat(3, {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
99 read(3, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"..., 4096) = 3073
100 fstat(4, {st_mode=S_IFREG|000, st_size=0, ...}) = 0
101 write(4, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"..., 3069) = 3069
102 read(3, "", 4096) = 0
103 fchown(4, 1000, 1000) = 0
104 fchmod(4, 0100644) = 0
105 close(3) = 0
106 close(4) = 0
107 rename("./sediSJ0Jh", "a.txt") = 0
108 close(1) = 0
109 close(2) = 0
110 exit_group(0) = ?
111 +++ exited with 0 +++
95行显示,打开了一个文件./sediSJ0Jh,fd为4
101行显示,对该fd进行了写操作
107行显示,对./sediSJ0Jh进行了重命名,为”a.txt“
vim 也执行了同样的类似的操作
查看执行前的inode
ls -i a.txt
12452049 a.txt
执行vim修改文件
strace -f -o vim.strace vim a.txt
# or
vim a.txt
VIMPID=`ps -ef |grep vim |grep -v grep |awk '{print $2}'`
sudo ltrace -p $VIMPID
查看执行结果
ls -i a.txt
12452058 a.txt
inode发生变化
1 user@user-cloud-nuc1:~$ tail -n 100 vim.strace
2 970 write(1, "w", 1) = 1
3 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
4 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
5 970 write(1, "\33[?25l\33[34h\33[?25h", 17) = 17
6 970 select(1, [0], [], [0], {tv_sec=4, tv_usec=0}) = 1 (in [0], left {tv_sec=3, tv_usec=888987})
7 970 read(0, "q", 4096) = 1
8 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
9 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
10 970 write(1, "q", 1) = 1
11 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
12 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
13 970 write(1, "\33[?25l\33[34h\33[?25h", 17) = 17
14 970 select(1, [0], [], [0], {tv_sec=4, tv_usec=0}) = 1 (in [0], left {tv_sec=3, tv_usec=738309})
15 970 read(0, "a", 4096) = 1
16 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
17 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
18 970 write(1, "a", 1) = 1
19 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
20 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
21 970 write(1, "\33[?25l\33[34h\33[?25h", 17) = 17
22 970 select(1, [0], [], [0], {tv_sec=4, tv_usec=0}) = 1 (in [0], left {tv_sec=3, tv_usec=555370})
23 970 read(0, "\r", 4096) = 1
24 970 select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
25 970 write(1, "\r", 1) = 1
26 970 stat("/home/user/a.txt", {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
27 970 access("/home/user/a.txt", W_OK) = 0
28 970 write(1, "\33[?25l", 6) = 6
29 970 ioctl(0, TCGETS, {B38400 opost -isig -icanon -echo ...}) = 0
30 970 ioctl(0, SNDCTL_TMR_START or TCSETS, {B38400 opost isig icanon echo ...}) = 0
31 970 ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0
32 970 getcwd("/home/user", 4096) = 11
33 970 write(1, "\"a.txt\"", 7) = 7
34 970 stat("a.txt", {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
35 970 access("a.txt", W_OK) = 0
36 970 getxattr("a.txt", "system.posix_acl_access", 0x7ffcd6162100, 132) = -1 ENODATA (No data available)
37 970 stat("a.txt", {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
38 970 lstat("a.txt", {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
39 970 lstat("4913", 0x7ffcd61624c0) = -1 ENOENT (No such file or directory)
40 970 openat(AT_FDCWD, "4913", O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW, 0100644) = 3
41 970 fchown(3, 1000, 1000) = 0
42 970 stat("4913", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
43 970 close(3) = 0
44 970 unlink("4913") = 0
45 970 stat("a.txt~", 0x7ffcd61621c0) = -1 ENOENT (No such file or directory)
46 970 stat("a.txt", {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
47 970 stat("a.txt~", 0x7ffcd6161190) = -1 ENOENT (No such file or directory)
48 970 unlink("a.txt~") = -1 ENOENT (No such file or directory)
49 970 rename("a.txt", "a.txt~") = 0
50 970 openat(AT_FDCWD, "a.txt", O_WRONLY|O_CREAT, 0644) = 3
51 970 ftruncate(3, 0) = 0
52 970 write(3, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"..., 3069) = 3069
53 970 fsync(3) = 0
54 970 stat("a.txt", {st_mode=S_IFREG|0644, st_size=3069, ...}) = 0
55 970 stat("a.txt", {st_mode=S_IFREG|0644, st_size=3069, ...}) = 0
56 970 fchmod(3, 0100644) = 0
57 970 close(3) = 0
58 970 setxattr("a.txt", "system.posix_acl_access", "\2\0\0\0\1\0\6\0\377\377\377\377\4\0\4\0\377\377\377\377 \0\4\0\377\377\377\377", 28, 0) = 0
59 970 write(1, " 1L, 3069C written", 18) = 18
60 970 lseek(4, 0, SEEK_SET) = 0
61 970 write(4, "b0VIM 8.0\0\0\0\0\20\0\0`\372\267^\321\0\276\0\312\3\0\0user"..., 4096) = 4096
62 970 stat("/home/user/a.txt", {st_mode=S_IFREG|0644, st_size=3069, ...}) = 0
63 970 unlink("a.txt~") = 0
64 970 getcwd("/home/user", 4096) = 11
65 970 openat(AT_FDCWD, "/home/user/.viminfo", O_RDONLY) = 3
66 970 stat("/home/user/.viminfo", {st_mode=S_IFREG|0600, st_size=22730, ...}) = 0
67 970 getuid() = 1000
68 970 getuid() = 1000
69 970 stat("/home/user/.viminfo.tmp", 0x7ffcd6162540) = -1 ENOENT (No such file or directory)
70 970 umask(000) = 002
71 970 openat(AT_FDCWD, "/home/user/.viminfo.tmp", O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW, 0600) = 5
72 970 umask(002) = 000
73 970 fcntl(5, F_GETFL) = 0x28001 (flags O_WRONLY|O_LARGEFILE|O_NOFOLLOW)
74 970 stat("/home/user/.viminfo.tmp", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
75 970 fstat(3, {st_mode=S_IFREG|0600, st_size=22730, ...}) = 0
76 970 read(3, "# This viminfo file was generate"..., 4096) = 4096
77 970 read(3, "f\\\\>\"\n? \\<name\\>\n|2,1,1562634451"..., 4096) = 4096
78 970 read(3, "|4,39,2335,48,1589114505,\"~/vim."..., 4096) = 4096
79 970 read(3, "89114187,\"~/vim.strace\"\n-' 975 "..., 4096) = 4096
80 970 fstat(5, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
81 970 write(5, "# This viminfo file was generate"..., 4096) = 4096
82 970 write(5, "f\\\\>\"\n? \\<name\\>\n|2,1,1562634451"..., 4096) = 4096
83 970 write(5, "~/vim.strace\n|4,39,2335,48,15891"..., 4096) = 4096
84 970 read(3, "7095\t0\n\t\"\t2487\t0\n\n> ~/dbtransfor"..., 4096) = 4096
85 970 write(5, "4200,\"~/vim.strace\"\n-' 1062 6 "..., 4096) = 4096
86 970 read(3, "0\n\t+\t86\t11\n\t+\t83\t18\n\t+\t86\t0\n\t+\t8"..., 4096) = 2250
87 970 write(5, "5037\t0\n\t\"\t79\t0\n\t^\t19\t0\n\t.\t76\t0\n\t"..., 4096) = 4096
88 970 read(3, "", 4096) = 0
89 970 write(5, "84\t7\n\t+\t85\t17\n\t+\t39\t34\n\t+\t42\t36\n"..., 2176) = 2176
90 970 close(5) = 0
91 970 close(3) = 0
92 970 stat("/home/user/.viminfo.tmp", {st_mode=S_IFREG|0600, st_size=22656, ...}) = 0
93 970 stat("/home/user/.viminfo", {st_mode=S_IFREG|0600, st_size=22730, ...}) = 0
94 970 unlink("/home/user/.viminfo") = 0
95 970 rename("/home/user/.viminfo.tmp", "/home/user/.viminfo") = 0
96 970 write(1, "\r\r\n\33[?1l\33>", 10) = 10
97 970 write(1, "\33[34h\33[?25h\33[?1049l", 19) = 19
98 970 close(4) = 0
99 970 unlink("/home/user/.a.txt.swp") = 0
100 970 exit_group(0) = ?
101 970 +++ exited with 0 +++
49行显示,原文件被命名为a.txt~
50行显示,重新创建了一个名为a.txt的文件。
windows执行和inux类似的操作。