how to recover deleted apache access log without using any Recovery tool

jsaravana87 · 05-26-2012, 08:06 AM

hI all,
Today one of my webserver unfortunately i had deleted off apache access log .As the resullt i could int able to start apache .I had created access_log in /etc/httpd/log/access_log and started the application .But anyone can help me how can i recover the previous deleted access_log without using any sort of recover tool

unSpawn · 05-26-2012, 08:32 AM

If you delete a file while it is still opened on some fle descriptor you can easily copy it out. If a process is stopped then even if you delete it remnants of a large file may still be spread across file system free space until they are reclaimed again but

Quote:

Originally Posted by arun5002

i had deleted off apache access log . (..) I had created access_log in /etc/httpd/log/access_log and started the application .

...by doing that you successfully thwarted recovery of the files contents. While lessons learned the hard way are usually the lessons you don't forget it doesn't have to be that way. Next time best ask before you do something.

jayakumar01 · 05-27-2012, 03:04 AM

hi unspawn ,

Quote:

If you delete a file while it is still opened on some file descriptor you can easily copy it out

.

How can i find the log is opened in some file descriptor

unSpawn · 05-27-2012, 04:06 AM

Find out the PID with 'pgrep name_of_process' or '\ps -C name_of_process', long-list name_of_process' /proc/PID/fd/ directory checking for the "(deleted)" text, then 'cp /proc/PID/fd/file_descriptor_nr /path/to/directory' (ensure /path/to/directory has enough free space to hold the file). To find all deleted files that are still in use use something like 'lsof -Pwln|grep deleted'. Automating the latter may look something like 'lsof -Pwln|awk '/\(deleted/ {print "/proc/"$2"/fd/"$4" "$9}'|while read FD DELF; do echo "cp ${FD/u/} /path/to/directory/$(basename $DELF)"; done;'.