Yesterday met a face questions - how to restore accidentally deleted nginx logs, I was just about to answer the ideas and steps. Night simulation time to recover accidentally deleted and scenes.
Learn about first under / proc directory (remember the exam RHCA when the topic for this directory really a lot). / Proc directory on the Linux system is a file system that proc file system, which is a pseudo-file system. Which holds some of the current information system kernel running state, you can view the associated system hardware and related information currently running processes, you can also change some of the file to change the kernel running. / Proc / PID process information stored is currently running, PID is the process ID, the process ends when the relevant directory will disappear.
Recover accidentally deleted nginx will use to log some files / proc / PID under the first look at what the directory has:
Several simple column:
- Attribute attr process
- Start the execution of the command cmdline
- Cwd current working directory, soft links
- Environ environment variables used in the execution process
- All documents fd process, file, called a file descriptor, the directory of each soft links point to the actual process of open files
- Hard and soft limits restrictions process
- Cgroup cgroup control group information of the process
- Operational status information status process
Nginx log recovery is to use a certain file descriptor fd under, because there are actually connected to each soft points when running nginx open files, including nginx log files.
Below simulation accidentally deleted the recovery process and logs.
See nginx logs:
[Root @ iZ2876x9bezZ ~] # ll / var / log / nginx /
-rw-r - r-- 1 root root 6991 Aug 12 12:48 access.log
-rw-r - r-- 1 root root 760 Aug 12 11:44 error.log
Delete the log:
See nginx process ID:
See the process file descriptor information:
Can be seen as a soft link file descriptor 5 points to the file has been deleted, this is what we need to restore the log files.
Check file contents:
You can see the entire contents of the log, and the new content will be added to the log within the file descriptor. Next, the content of these logs can be output to a file, and then perform the nginx reload operation, so you can re-generate a access.log file, and the new contents of the log output into the log file.