Shulou(Shulou.com)06/01 Report--

This article mainly introduces how to restore the deleted syslog-/var/log/messages file under linux, has a certain reference value, interested friends can refer to, I hope you can learn a lot after reading this article, the following let the editor take you to understand it.

One of the mistakes that novices in Linux often make is to delete the log file directly, rather than delete the contents of the log file.

Deleting a log file directly often causes the newly generated log record to not be written to the log file (because it has been deleted), and simply touch a file with the same name will not solve the problem.

Taking the Unbutu system as an example, this paper introduces how to restore the mistakenly deleted syslog files:

First, as the root user, execute the following lsof command to query the process ID (PID) of the process that opened the / var/log/messages file.

The code is as follows:

Root@zck:/var/log# lsof | grep messages

Rsyslogd 544 syslog 7w REG 8,1 214641 134422 / var/log/messages

As you can see from the command output above, the PID of the process that opened the / var/log/messages file is 544, and the file descriptor (FD) number of the file / var/log/messages is 7.

According to the above PID and FD, you can find the corresponding file at / proc:

The code is as follows:

Root@zck:/var/log#ls-al / proc/544/fd/7

Lmurwx-1 root root 64 2012-07-14 14:48 7-> / var/log/messages

Copy the file / proc/544/fd/7 to / var/log/messages

Cp / proc/544/fd/7 / var/log/messages

Then restart the syslog service to restore the mistakenly deleted log file, and new log records can continue to be written to the log file.

Run the service command as the root user. Where the second argument to the service command may be syslog or rsyslog.

You can use the command query to know the details.

The code is as follows:

Root@zck:/proc/544/fd# service-status-all

[?]...

[?] Rc.local

[?] Rsyslog

[?] Screen-cleanup

[?]...

#--

The code is as follows:

Root@zck:/proc/544/fd# service rsyslog restart

Rsyslog start/running, process 2673

Clear the log file:

Cat / dev/null > / var/log/messages

Thank you for reading this article carefully. I hope the article "how to restore the deleted syslog-/var/log/messages files under linux" shared by the editor will be helpful to you. At the same time, I also hope you can support us and pay attention to the industry information channel. More related knowledge is waiting for you to learn!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.