Search in snapshots

Hi,

I am new to Restic and before I start I want to thank you for the work provided.
I am currently testing/validating your tool for my daily backups of multiple servers.

I have a question to which I have not yet found an answer, is it possible to have a list of snapshots in which it finds a given files?

Regards

Have you checked out restic find yet?
This seems to be what you are looking for

The “find” command searches for files or directories in snapshots stored in the repo.

As an example:

$ restic find ssh-audit.py
repository 75013bf5 opened successfully, password is correct
Found matching entries in snapshot 049c3b0de99cadcfff6cef69b6046611b4b5ab2d321ce33066f5092cd5b3f06a
/home/moritz/scripts/ssh-audit.py

Found matching entries in snapshot 0621af4de7d6e9d125e575c4045902522abb6bbf32a45da3b6230e1dd6517165
/home/moritz/scripts/ssh-audit.py

Found matching entries in snapshot 063906f5cc71abdf6b91a24df326f3e637798f61db58cf642102d76de67d3643
/home/moritz/scripts/ssh-audit.py

Found matching entries in snapshot 07ee09148eb4a18b440ae4e8abc62af603441db165b2914607d573dfffdd60d0
/home/moritz/scripts/ssh-audit.py

You could then use something like --json output in conjunction with jq to find exactly what you need and format it a little bit.
The json output will give you way more detailed information of the file(s) in each snapshot it is in.
As seen here Manual — restic 0.16.3 documentation

Yes i have see this, but for me this don’t return the same things, for example:

$ restic snapshots
password is correct
ID        Date                 Host        Tags        Directory
----------------------------------------------------------------------
0ab4c9fd  2018-05-31 09:13:21  ct17112501              /vzdump_excluded
ea4ff900  2018-05-31 09:14:26  ct17112501              /vzdump_excluded
2d47bc25  2018-05-31 09:15:38  ct17112501              /vzdump_excluded
----------------------------------------------------------------------
3 snapshots

If i try restic ls

$ restic ls --path /vzdump_excluded | grep "php7.0-fpm.log$"
/vzdump_excluded/backup/rsnapshot/alpha.0/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.1/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.2/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.3/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.0/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.1/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.2/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.3/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.0/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.1/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.2/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.3/localhost/var/log/php7.0-fpm.log

I see 12 result, 4 by snapshots but the result of the find command is:

$ restic find php7.0-fpm.log
password is correct
Found matching entries in snapshot 0ab4c9fd4eaf2afe060aa4fc35071b88426aef53f0c7fb224e6fafbe285d30a7
/vzdump_excluded/backup/rsnapshot/alpha.0/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.1/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.2/localhost/var/log/php7.0-fpm.log
/vzdump_excluded/backup/rsnapshot/alpha.3/localhost/var/log/php7.0-fpm.log

The file is found only in one snapshots … I don’t know why, and you ?

Regards

Which exact version of restic are you running right now?

$ ./restic version
restic 0.9.0 compiled with go1.10.2 on linux/amd64

So restic find should, like in my example, output all snapshots containing the file you are looking for.
Snapshot by snapshot.
Have you waited enough for the find command to finish? I don’t know how big each snapshot is and how much data needs to be parsed to find the file. So maybe wait a bit longer and let the command fully finish

My snapshots are not that big (~ 260Mb), and I do not stop the process before it stops itself.

It’s weird …

That’s weird, would you mind reporting an issue on GitHub (ideally with instructions on how to reproduce it)? Recently, there was another issue with restic find where it doesn’t work as expected, so something strange is going on (see #1823)