Use snapshots with limits

An LVM snapshot initially shares data with its origin and stores changed blocks separately.

Creating one is nearly instant because nothing is copied up front. The snapshot presents the volume exactly as it was at creation time. As the origin changes, the original version of each changed block gets written into the snapshot’s space — copy-on-write.

That gives you the one thing file-copy backups lack on a busy volume: a frozen, consistent view. Copying a live filesystem for an hour captures files from different moments. Copying from a snapshot captures one moment.

Create, use, remove

Give the snapshot enough space to absorb the changes you expect during the backup window:

sudo lvcreate --snapshot --size 5G --name data-snap /dev/vg0/data
sudo mount -o ro /dev/vg0/data-snap /mnt/snap
sudo rsync -aHAX /mnt/snap/ /mnt/backups/data/

Mounting read-only makes the intent clear: this is a source to copy from, not a place to work in.

Snapshots consume space as the origin changes and can fill. Monitor while the copy runs:

sudo lvs vg0
#  LV        VG  Attr       LSize   Origin Data%
#  data      vg0 owi-aos--- 100.00g
#  data-snap vg0 swi-a-s---   5.00g data   38.20

Data% is the number to watch. If it reaches 100 the snapshot becomes invalid, and your backup source vanishes mid-copy. The origin volume keeps working; only the snapshot dies. If Data% climbs fast, the write load is heavier than you sized for.

When the copy finishes, remove the snapshot:

sudo umount /mnt/snap
sudo lvremove vg0/data-snap

Don’t leave snapshots around. An old, forgotten snapshot keeps absorbing writes, slows the origin, and eventually fills.

What a snapshot is not

They usually share the same failure domain as the source disk. If the disk dies, the origin and the snapshot die together. A snapshot is a consistency tool, not a backup. Use them to obtain a consistent backup view, monitor them, then remove them — and send the actual copy somewhere independent.

Plan a snapshot-assisted backup for one busy filesystem. Define quiescing, snapshot size, monitoring, copy destination, validation, and cleanup.