0

By using strace on the active rsync process, I can see output like:

read(4, "9\0\0\7\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1"..., 16384) = 61
write(3, "\357\265mD0e\233:\337\250\241\363\255 \307\5\213\224d\322\323\203i\2671\222m'\252\354\n\211"..., 96) = 96

I've done some googling and didn't come up with a good answer, but could anyone explain to me how to make sense of the encoding above?

I assume it's some kind of encoding where each single character is escaped, and that the read and write calls above are using file-names. So what does it all mean, and how could I convert it easily to human readable strings?

My apologies for not providing more detailed information in the initial posting! What I was doing is to run a command like:

/usr/bin/time /usr/bin/ionice -c3 /usr/bin/rsync -cavzP --fake-super --exclude=' bla bla...' --bwlimit=40000 / backup@backup:/mnt/storagedisk/workstation-backup/

ps aux | grep rsync would then show something like:

root      7875  0.0  0.0   4064   348 pts/5    S+   20:29   0:00 /usr/bin/time /usr/bin/ionice -c3 /usr/bin/rsync -cavzP --fake-super --exclude=... --bwlimit=40000 / backup@backup:/mnt/storagedisk/workstation-backup
root      7876 15.3  0.2  52656  8384 pts/5    D+   20:29   0:02 /usr/bin/rsync -cavzP --fake-super --exclude=...  --bwlimit=40000 / backup@backup:/mnt/storagedisk/workstation-backup/
root      7877  0.0  0.0  41680  3252 pts/5    S+   20:29   0:00 ssh -l backup backup rsync --server -vlogDtprcze.iLsf --bwlimit=40000 --partial . /mnt/storagedisk/workstation-backup/

To be honest, at this point I'm not entirely sure if it was process number 2 or 3 in that list I connected to with strace. I think it was process number 2 in that list, and I was a bit surprised I didn't see filenames in the strace output there, but it might as well have been process 3, and then it makes sense that the read/writes are content transferred over the network.

My apologies again for not providing detailed information the first time asking, and my initial question now seems a bit far out, as I didn't understand quite what I was looking at, so either the whole question should be rephrased, or deleted entirely as it wasn't very specific. I let the mods decide. :)

  • 2
    I'm going to assume that's the network stream (there's very little info to work with here). If so, that could be the content of what's being transferred, if going over SSH, that could be an encrypted stream, it could be protocol data, etc. – Patrick Sep 11 '14 at 12:58
  • rsync doesn't encode anything. Are you perhaps using -z as an option? (You don't show the command.) That compresses the data, which will of course lead to filenames also being compressed. – wurtel Sep 11 '14 at 13:00
  • @Patrick: A network capture (e.g., Wireshark, etc.) could certainly show encrypted data, but when would an strace of rsync show encrypted data? Wouldn't rsync be talking to ssh over a FIFO, and wouldn't those communications be in the clear? (Or does rsync implement the SSH protocol & encryption itself, internally?) – G-Man Sep 11 '14 at 15:34
  • @G-Man strace shows the system calls, meaning at the border between user space and kernel space. Things like decryption, and decompression are entirely userspace. Thus you're viewing the data as it enters userspace, before decompression/decryption. – Patrick Sep 11 '14 at 15:36
  • 1
    @G-Man dunno. There's very little information in this question. Could be the decompression portion, which I believe is handled by the rsync binary, it could be that strace was run so that it follows forks, and we're looking at the ssh process. It could be we're looking at the binary data of whatever is being transferred, etc. – Patrick Sep 11 '14 at 15:43
1
/usr/bin/rsync -cavzP --fake-super --exclude=' bla bla...' --bwlimit=40000 ...
                   ^-- compress flag

You're running rsync with the flag that tells it to perform its own compression. The data that you're seeing being read and written is the compressed data stream. To make sense of the data, you'd have to apply the DEFLATE decompression algorithm to it.

If you were to remove the z flag, the rsync I/O would probably be more recognizable.

0

The manpage says the following:

Character pointers are dereferenced and printed as C strings. Non-printing characters in strings are normally represented by ordinary C escape codes. Only the first strsize (32 by default) bytes of strings are printed; longer strings have an ellipsis appended following the closing quote.

What you are seeing in FD3 and FD4 is probably the encrypted data (at least it you use ssh).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.