Should I use `mdadm --create` to recover my RAID?

Question

There's this guy that keeps telling me that we shouldn't use mdadm --create to recover our RAID arrays, that it's worse than evil, is an error. Why is that? I mean I should get my RAID working again, no? What should I use instead if --create is a mistake?

Answer 1

There is nothing wrong with --create - if you know what you are doing.

The only problem is: You don't know.

When you create a RAID, the command is usually something short, like:

mdadm --create /dev/md42 --level=5 --raid-devices=3 /dev/sdx1 /dev/sdy1 /dev/sdz1

Dead simple, right?

Except it isn't, really. RAID has a lot more variables. There's a data offset, a chunksize, a metadata version, and let's not forget the drive order which is easy to get wrong on a re-create, as drive letters may change over time.

Here's what a proper --create command might look like instead:

mdadm --create /dev/md42 --assume-clean \
    --level=5 --chunk=512K --metadata=1.2 --data-offset=2048s \
    --raid-devices=3 /dev/sdz1 missing /dev/sdy1

And whatever that gives you, you should test it read-only. And that may not be everything. Did you know that there are several different RAID layouts, too? --create is the very last straw and the pitfalls are not obvious. Ideally, you should backup all disks, or at least the metadata areas, or operate on a copy-on-write overlay.

For anything you do not provide, mdadm uses default settings. Unfortunately those are not set into stone, basically all of them changed in the past, and they are likely to change again in the future.

So when you use --create for recovery, you have to understand RAID really well, and you need to know what your old RAID looked like exactly. And then you have to add --assume-clean or leave one of the disks as missing, just in case you made a mistake anyway. You should also make a backup, at the very least of the beginning and end of the disk so you can recover from metadata written to the wrong location.

In most cases you have other options. --assemble --force is one, but it has its own pitfalls. You should --examine first and if one of the drives is more outdated than the others, you should not include that in the assembly. There is also --build as well as dmsetup for raid which does not use metadata, and might let you access your data. That doesn't mean it is safe, however - you write on it, you lose data if the settings you picked are wrong.

In general, data recovery is a wide field. You need experience in order to be able to decide on the correct course of action. Avoid the issue if possible; make backups, document your setup, and monitor your disks so your RAID does not die in the first place.