Linux accidentally delete log files how to restore syslog

This article mainly introduces "Linux accidentally delete log files syslog how to restore", in the daily operation, I believe that many people in Linux accidentally delete log files syslog how to restore the problem, the editor looked up all kinds of information, sorted out a simple and useful method of operation, hope to answer the "Linux accidentally delete log files syslog how to restore" doubts help! Next, please follow the editor to study!

Taking the Unbutu system as an example, the following shows how to restore the deleted syslog:

First, as the root user, execute the following lsof command to query the process ID (PID) of the process that opened the / var/log/messages file.

Root@ www.linuxidc.com: / var/log# lsof | grep messages

Rsyslogd 544 syslog 7w REG 8,1 214641 134422 / var/log/messages

As you can see from the command output above, the PID of the process that opened the / var/log/messages file is 544, and the file descriptor (FD) number of the file / var/log/messages is 7.

According to the above PID and FD, you can find the corresponding file at / proc:

Root@ www.linuxidc.com: / var/log#ls-al / proc/544/fd/7

Lmurwx-1 root root 64 2012-07-14 14:48 7-"/ var/log/messages

Copy the file / proc/544/fd/7 to / var/log/messages

Cp / proc/544/fd/7 / var/log/messages

Then restart the syslog service to restore the mistakenly deleted log file, and new log records can continue to be written to the log file.

Run the service command as the root user. Where the second argument to the service command may be syslog or rsyslog.

You can use the command query to know the details.

Root@ www.linuxidc.com: / proc/544/fd# service-- status-all

[? ] .

[? ] rc.local

[? ] rsyslog

[? ] screen-cleanup

[? ] .

Root@ www.linuxidc.com: / proc/544/fd# service rsyslog restart

Rsyslog start/running, process 2673

BTW, the real command to empty the log file should be:

Cat / dev/null "/ var/log/messages

At this point, the study on "Linux accidentally deletes the log file syslog how to restore" is over. I hope to be able to solve your doubts. The collocation of theory and practice can better help you learn, go and try it! If you want to continue to learn more related knowledge, please continue to follow the website, the editor will continue to work hard to bring you more practical articles!