LPIC-2 System Maintenance: Backup, Restore, and User Notification

There is no single "backup command" on Linux, and that is by design. A backup tool makes a trade-off between portability, speed, and fidelity, and no one tool wins on all three. The LPIC-2 skill — and the real-world skill — is matching the tool to the job.

Think of it like a toolbox of containers for moving house. A cardboard box (tar) is portable: anyone can carry it anywhere and open it later. A moving crew that only carries what changed since yesterday (rsync) is fast on repeat trips. A photograph of the whole room, every pixel (dd) is a perfect raw copy but huge and rigid. A labelled inventory taken in waves (dump/restore) records exactly what changed at each level. You would not photograph a room to move one chair, and you would not mail a moving crew across the country for a single archive.

Here is the cheat-sheet you will spend the rest of the lesson earning:

• `tar` — bundle files into one portable archive (backup.tar, often gzip'd to .tar.gz). Great for shipping a directory somewhere or keeping a dated snapshot file.
• `rsync` — incremental copying, locally or over the network. Only transfers the differences, so the second run is fast. The workhorse for mirrors and repeat backups.
• `dd` — a raw block-level image of a whole disk or partition. Copies bytes, not files, so it captures partition tables, boot sectors, and unused space. Used for cloning disks and disk imaging.
• `dump`/`restore` — filesystem-level, leveled backups for ext2/3/4. Understands the filesystem directly and supports incremental "levels" (level 0 = full, higher = only changes since a lower level).

Start with the two extremes: `tar` works at the file level (it copies files and their metadata), while `dd` works at the block level (it copies raw bytes off the device and ignores the concept of files entirely).

dd is a different universe. It does not see files — it copies raw blocks from one device or file to another. That is exactly what you want when you need to clone an entire disk including its partition table and boot sector, which file-based tools never capture.

rsync is the everyday backup workhorse because it is incremental: after the first copy, it transfers only the differences, so repeat runs are fast even over a slow link. It works locally or over SSH to a remote host. But it has one rule that catches every newcomer at least once: a trailing slash on the source changes what gets copied.

For a remote backup, the destination becomes user@host:/path. rsync tunnels over SSH automatically:

Plain rsync only adds and updates — it never removes files from the destination. That means a file you deleted from the source lingers in the backup forever. To make the destination an exact mirror of the source, you add --delete.

The last power feature is `--link-dest`, which gives you snapshot backups that barely use disk. Point it at the previous backup, and any file that hasn't changed is stored as a hard link to the old copy instead of a fresh duplicate. Unchanged files cost almost nothing; only changed files use new space — yet every snapshot directory looks like a complete, standalone backup.

Maintenance that drops a service or reboots a box affects whoever is logged in. The professional move is to warn them first. Two tools cover this: `wall` broadcasts a message to every logged-in terminal right now, and `shutdown` schedules a reboot/poweroff for later and notifies users automatically as the time approaches.

When you need to actually reboot, shutdown does the warning and the action. You give it a time — a clock time like 22:00, a delay like +15 (fifteen minutes), or now — and it both schedules the event and nags logged-in users as it nears.

Three files control the text users see around login, and the entire trick is before vs after login.

• `/etc/motd` — the "message of the day", shown after a successful login. The user is already authenticated. Good for welcome notes, maintenance windows, or pointers to docs.
• `/etc/issue` — shown before login at the local console prompt. The user hasn't authenticated yet.
• `/etc/issue.net` — shown before login for network logins (e.g. Telnet, and SSH when configured to display it).

The analogy: `/etc/issue` is the sign on the front door (everyone sees it before entering); `/etc/motd` is the note on the kitchen fridge (only people already inside the house read it).

You have a real root shell. Every command below is read-only or a dry run — nothing is created, copied, or deleted. Run them in order to see the tools and banners on your actual system.