Tuesday, November 17, 2009

Restoring a file that still has an open filehandle on Linux

My rm /var/log/access_log* was a little greedier than I wanted it to be. What I meant to use was rm /var/log/access_log.* :-( . Never fear, apache didn't know I had deleted the file as it had an open filehandle and was happily logging away, but how to restore it? Check out the step by step:



# lsof | grep access_log
apache2 1649 root 8w REG 8,1 0 4334715 /var/log/apache2/access_log (deleted)
apache2 15265 www-data 8w REG 8,1 0 4334715 /var/log/apache2/access_log (deleted)
apache2 15266 www-data 8w REG 8,1 0 4334715 /var/log/apache2/access_log (deleted)
# cd /proc/1649/fd
# ls -alh
total 0
dr-x------ 2 root root 0 2009-11-17 18:31 .
dr-xr-xr-x 7 root root 0 2009-11-17 16:15 ..
lr-x------ 1 root root 64 2009-11-17 18:32 0 -> /dev/null
l-wx------ 1 root root 64 2009-11-17 18:32 1 -> /dev/null
l-wx------ 1 root root 64 2009-11-17 18:32 2 -> /var/log/apache2/error_log
lrwx------ 1 root root 64 2009-11-17 18:32 3 -> socket:[5823]
lrwx------ 1 root root 64 2009-11-17 18:32 4 -> socket:[5824]
lr-x------ 1 root root 64 2009-11-17 18:32 5 -> pipe:[576841]
l-wx------ 1 root root 64 2009-11-17 18:32 6 -> pipe:[576841]
l-wx------ 1 root root 64 2009-11-17 18:32 8 -> /var/log/apache2/access_log (deleted)
# cat 8 > /var/log/apache2/access_log && /etc/init.d/apache2 stop && /etc/init.d/apache2 start
Woot!

No comments:

Post a Comment