If you deleted a file on linux based OS accidentally, and want to recover it, lsof command may help you.
lsof is a Linux tool which can show open files and network connections, and even recover deleted files.
If you have ever deleted a file by mistake; been clearing up log files, or just used rm without thinking, there is a way of recovering that deleted file. For example, to recover a missing access_log used by Apache you can search for it via this command:
$ lsof | grep access_log
which output will be similar to:
httpd 26120 apache 42w REG 253,0 5852 12222531 /apachelogs/access_log (deleted)
The key word to look for here is deleted in brackets. The good news is a process (26120) still has the file open and without this process keeping the file open we would have lost the file permanently. So, with the Apache daemon helping us out we can view the missing info by looking inside the proc filesystem, the process id (26120), and finally in the file descriptor (fd):
$ cat /proc/26120/fd/42
This outputs the contents of my deleted access_log which shows the data is still there. All you need to do now is simply redirect the contents back to /apachelogs/access_log, like this:
$ cat /proc/26120/fd/42 > /apachelogs/access_log
Now you have recovered your access_log with all the data back to its original location. (You should also restart Apache). lsof can do much more, however, this is one example which could save the day.
Feel free to share other useful example of lsof here (in comments).
lsof is a Linux tool which can show open files and network connections, and even recover deleted files.
If you have ever deleted a file by mistake; been clearing up log files, or just used rm without thinking, there is a way of recovering that deleted file. For example, to recover a missing access_log used by Apache you can search for it via this command:
$ lsof | grep access_log
which output will be similar to:
httpd 26120 apache 42w REG 253,0 5852 12222531 /apachelogs/access_log (deleted)
The key word to look for here is deleted in brackets. The good news is a process (26120) still has the file open and without this process keeping the file open we would have lost the file permanently. So, with the Apache daemon helping us out we can view the missing info by looking inside the proc filesystem, the process id (26120), and finally in the file descriptor (fd):
$ cat /proc/26120/fd/42
This outputs the contents of my deleted access_log which shows the data is still there. All you need to do now is simply redirect the contents back to /apachelogs/access_log, like this:
$ cat /proc/26120/fd/42 > /apachelogs/access_log
Now you have recovered your access_log with all the data back to its original location. (You should also restart Apache). lsof can do much more, however, this is one example which could save the day.
Feel free to share other useful example of lsof here (in comments).
