恢复卡在Linux shell进程中的已删除文件

Question

I have a background process that is running for a long time and using a file to write the logs in it. It`s size has increased too large. I just deleted the file and created a new one with the same name and same permission and ownership but the new file does not get any entry. Old file is marked as deleted and still being used by the process which can clearly be seen by lsof command.

Plz let me know, is there any way that I can recover that file and.

Your positive response will really be much helpful.

Answer 1

If the file is still open by some process, you can recover it using the /proc filesystem.

First, check the file descriptor number under which that file is opened in that process. If the file is opened in a process with PID X , use the lsof command as follows:

lsof -p X

This will show a list of files that are currently opened by X . The 4th column shows the file descriptors and the last column shows the name of the mount point and file system where the file lives (ignore the u , r and other flags after the file descriptor number, they just indicate whether the file is opened for reading, writing, etc.)

If the file descriptor number is Y , you can access its contents in /proc/X/fd/Y . So, something like this would recover it:

cp /proc/X/fd/Y /tmp/recovered_file