Shulou(Shulou.com)05/31 Report--

Most people do not understand the knowledge points of this article "Linux production environment carelessly implement rm-f recovery", so the editor summarizes the following content, detailed content, clear steps, and has a certain reference value. I hope you can get something after reading this article. Let's take a look at this "Linux production environment carelessly implement rm-f how to restore" article.

Simulated scene

1. Delete

Mistakenly delete the MySql.Data.dll file under the server directory / root/selenium/Spider:

> rm-f / root/selenium/Spider/MySql.Data.dll

> ll / root/selenium/Spider/MySql.Data.dll

Ls: cannot access / root/selenium/Spider/MySql.Data.dll: No such file or directory

two。 Restore

(1) use the lsof command to see if there is a process opening the / root/selenium/Spider/MySql.Data.dll file:

> lsof | grep / root/selenium/Spider/MySql.Data.dll

As you can see from above, the current file status is deleted (deleted).

(2) check whether there is recovery data:

/ proc/13067/fd: the directory of file descriptors for the process operation.

86: file descriptor.

> cat / proc/13067/fd/86

(3) restore files using Istroke O redirection

> cat / proc/23778/fd/86 > / root/selenium/Spider/MySql.Data.dll

> ls-l / root/selenium/Spider/MySql.Data.dll

-rw-r--r-- 1 root root 702464 Feb 10 12:03 / root/selenium/Spider/MySql.Data.dll

Rerun the program:

Indicates that there is nothing wrong with the recovered files. get to the bottom of

The whole process of restoring a file is demonstrated through the previous simulation scenario, so what is the principle and under what circumstances the file is recoverable.

In the Linux system, each running program has a host process isolated from each other, represented by the / proc/ process number (Linux is essentially a file system), for example: ls-l / proc/13067 to view the process information with a PID of 13067 When the program runs, the operating system will specially open up a memory area for the current process to use. For dependent files, the operating system will issue a file descriptor to read and write the file. When we execute rm-f to delete the file, it only deletes the directory index node of the file, which is not visible to the file system, but is still visible to the process that opened it. That is, you can still use the previously issued file descriptor to read and write the file, which is based on this principle, so we can use the Imap O redirection to restore the file.

The above is about the content of this article on "how to restore rm-f carelessly in Linux production environment". I believe we all have a certain understanding. I hope the content shared by the editor will be helpful to you. If you want to know more related knowledge, please pay attention to the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.