进程与资源管理篇——《linux使用lsof恢复误删除的nginx日志》

# 1.确保nginx在运行中，有日志数据
[root@localhost ~]# tail -f /var/log/nginx/access.log
[root@localhost fd]# ps -ef | grep nginx
root       1791      1  0 19:25 ?        00:00:00 nginx: master process nginx
nginx      1792   1791  0 19:25 ?        00:00:00 nginx: worker process
root       6657   1577  0 21:08 pts/0    00:00:00 tail -f /var/lognginx/access.log
root       6743   5565  0 21:09 pts/1    00:00:00 grep --color=auto nginx

# 2.lsof查看关于该日志文件的进程
[root@localhost fd]# lsof | grep /var/log/nginx/access.log
nginx     1791         root    5w      REG              253,0     27126   33639567 /var/log/nginx/access.log (deleted)
nginx     1792        nginx    5w      REG              253,0     27126   33639567 /var/log/nginx/access.log (deleted)
tail      6657         root    3r      REG              253,0     27126   35221510 /var/log/nginx/access.log

# 3.模拟误删该文件
[root@localhost fd]# rm -f /var/log/nginx/access.log
[root@localhost fd]# ll /var/log/nginx/access.log
ls: cannot access /var/log/nginx/access.log: No such file or directory

# 4.再次查看该日志文件描述符（多了deleted被删除的标记）

# 5.进入Linux中管理所有进程的目录/proc,找到对应进程id目录（父亲进程id）
[root@localhost fd]# cd /proc

# 6.进入管理文件描述符的地方

# 7.看到的5个软链接文件，就对应刚才的access.log日志文件，恢复该文件描述符的数据，到日志文件即可完成文件恢复
[root@localhost fd]# cat 5 > /var/log/nginx/access.log