Linux accidentally delete the log file syslog how to do?

The system needs to clean up the contents of the log file for a long time, but sometimes the log file is deleted because of carelessness, instead of clearing the log content. How to deal with this situation? In fact, the deleted log file syslog can be recovered, let's take a look at it.

Below Unbutu system as an example of how to undelete syslog:

First, lsof execute the following command as root user, open the query /var /log /messages The process ID (PID) of the file's process.

root@ www.linuxidc.com :/var/log# lsof |  Grep messages

rsyslogd 544 syslog 7w REG 8,1 214641 134422 /var/log/messages

From the above command output you can see that this process opens the /var/log/messages file. The PID is 544, and the file descriptor (FD) number of the file /var/log/messages is 7.

According to the above PID and FD, you can find the corresponding file in /proc:

root@ www.linuxidc.com :/var/log#ls -al /proc/544/fd /7

l-wx------ 1 root root 64 2012-07-14 14:48 7 -》 /var/log/messages

Will file /proc/544 Copy /fd/7 to /var/log/messages

cp /proc/544/fd/7 /var/log/messages

Then restart the syslog service to recover from accidental deletion. The log file, and the new log record can continue to be written to the log file.

Run the service command as the root user. The second parameter of the service command may be syslog or rsyslog.

Specifically, you can use the query to know.

root@ www.linuxidc.com :/proc/544/fd# service --status-all

[ ? ]. . .

[ ? ] rc.local

[ ? ] rsyslog

[ ? ] screen-cleanup

[ ? ]. . .

root@ www.linuxidc.com :/proc/544/fd# service rsyslog restart

rsyslog start/running, process 2673

BTW, really used to clear the log The file command should be:

cat /dev/null"/var/log/messages

The above is the method of Linux accidentally deleting the log file syslog. This article takes Ubuntu as an example, other The system can be used as a reference, and you need to pay attention to the next time you clean up the log files.