How to recover accidentally deleted messages files in Linux

If there are files that are being used by a process and are deleted by mistake, they can be recovered. If no process is using it, the accidentally deleted files cannot be recovered.

If the /var/log/messages file is deleted by mistake:

1. Query the process that is using the file.

[root@www]# lsof |grep message
rsyslogd 1717 root 1w REG 8,2 243321 654968 /var/log/messages

2. According to the query results, the process with PID 1717 is using the file. Enter the directory /proc/1717/fd under the process /proc:

[root@www fd]#ll
total 0
lrwx------ 1 root root 64 Jan 10 14:34 0 -> socket:[11015]
l-wx------ 1 root root 64 Jan 10 14:34 1 -> /var/log/messages
l-wx------ 1 root root 64 Jan 10 14:34 2 -> /var/log/secure
lr-x------ 1 root root 64 Jan 10 14:34 3 -> /proc/kmsg
l-wx------ 1 root root 64 Jan 10 14:34 4 -> /var/log/maillog
l-wx------ 1 root root 64 Jan 10 14:34 5 -> /var/log/cron

3. Query file 1, which corresponds to the messages log. Use cat 1 > /var/log/messages to copy it back, and then restart the syslogd service.

Summarize

The above is the full content of this article. I hope that the content of this article will have certain reference learning value for your study or work. Thank you for your support of 123WORDPRESS.COM. If you want to learn more about this, please check out the following links