Linux error delete messages file to find the method

If a process is using a file, if it was deleted by mistake, it can be retrieved. If no process is in use, you cannot retrieve the file deleted by mistake.

If the /var/log/messages file is deleted by mistake:

1. Query the process that is using the file.

[root@www]# lsof |grep message
rsyslogd 1717   root  1w   REG        8,2  243321   654968 /var/log/messages

2. According to the query, the process that is PID for 1717 is using the file. Enter the directory under the process /proc /proc/1717/fd:

[root@www fd]# ll
total 0
lrwx------ 1 root root 64 Jan 10 14:34 0 -> socket:[11015]
l-wx------ 1 root root 64 Jan 10 14:34 1 -> /var/log/messages
l-wx------ 1 root root 64 Jan 10 14:34 2 -> /var/log/secure
lr-x------ 1 root root 64 Jan 10 14:34 3 -> /proc/kmsg
l-wx------ 1 root root 64 Jan 10 14:34 4 -> /var/log/maillog
l-wx------ 1 root root 64 Jan 10 14:34 5 -> /var/log/cron

3. Query file 1 corresponds to the messages log, using cat 1 > /var/log/messages copy back and restart the syslogd service.

conclusion