进程运行时，日志文件被误删，如何恢复？

1. 先启动一个ping程序持续输出到一个文件中

[root@nicole-node1 ~]# ping 192.168.183.131 > ~/test.nicole &
[1] 65694

2. lsof 显示下相关信息

[root@nicole-node1 ~]# lsof ~/test.nicole
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ping 65694 root 1w REG 8,3 565 71263587 /root/test.nicole

3. 删除输出的文件 

[root@nicole-node1 ~]# rm ~/test.nicole
rm: remove regular file ‘/root/test.nicole’? y

4. 再次显示打开的文件，表示无该文件

[root@nicole-node1 ~]# lsof ~/test.nicole
lsof: status error on /root/test.nicole: No such file or directory
lsof 4.87
latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/
latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man
usage: [-?abhKlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-f[gG]] [+|-e s]
[-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]] [-p s]
[+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [--] [names]
Use the ``-h'' option to get more help information.

5. 通过ps 获取pid 65694

[root@nicole-node1 ~]# ps auxww|grep -i ping
zabbix     3008  0.0  0.2 260160  2420 ?        S    May24   0:06 /usr/sbin/zabbix_server: icmp pinger #1 [got 0 values in 0.000006 sec, idle 5 sec]
root      65694  0.0  0.0 114380   692 pts/0    S    07:38   0:00 ping 192.168.183.131
root      65710  0.0  0.0 112648   972 pts/0    S+   07:39   0:00 grep --color=auto -i ping

6.进入/proc/65694/fd，ls -l下可以看到fd与文件名的链接。

[root@nicole-node1 65694]# cd /proc/65694/fd

[root@nicole-node1 fd]# ls -l
total 0
lrwx------ 1 root root 64 May 27 07:38 0 -> /dev/pts/0
l-wx------ 1 root root 64 May 27 07:38 1 -> /root/test.nicole (deleted)
lrwx------ 1 root root 64 May 27 07:38 2 -> /dev/pts/0
lrwx------ 1 root root 64 May 27 07:38 3 -> socket:[647220]

7. tail 对应的fd，这边是1，显示还在持续写入，将对应的文件拷出来，可以看到拷出来的文件不再写了。这点可以理解，毕竟cp后整个inode和block都与之前的不同了。

[root@nicole-node1 fd]# cp 1 ~/.
[root@nicole-node1 fd]# tail -f 1
64 bytes from 192.168.183.131: icmp_seq=85 ttl=64 time=0.401 ms
64 bytes from 192.168.183.131: icmp_seq=86 ttl=64 time=0.347 ms
64 bytes from 192.168.183.131: icmp_seq=87 ttl=64 time=0.334 ms
64 bytes from 192.168.183.131: icmp_seq=88 ttl=64 time=0.373 ms
64 bytes from 192.168.183.131: icmp_seq=89 ttl=64 time=0.311 ms
64 bytes from 192.168.183.131: icmp_seq=90 ttl=64 time=0.353 ms
64 bytes from 192.168.183.131: icmp_seq=91 ttl=64 time=0.444 ms
64 bytes from 192.168.183.131: icmp_seq=92 ttl=64 time=0.351 ms
64 bytes from 192.168.183.131: icmp_seq=93 ttl=64 time=0.308 ms
64 bytes from 192.168.183.131: icmp_seq=94 ttl=64 time=1.62 ms
64 bytes from 192.168.183.131: icmp_seq=95 ttl=64 time=0.204 ms
64 bytes from 192.168.183.131: icmp_seq=96 ttl=64 time=0.325 ms
^C
[root@nicole-node1 fd]# ls ~/1
/root/1
[root@nicole-node1 fd]# tail ~/1
64 bytes from 192.168.183.131: icmp_seq=78 ttl=64 time=0.489 ms
64 bytes from 192.168.183.131: icmp_seq=79 ttl=64 time=0.244 ms
64 bytes from 192.168.183.131: icmp_seq=80 ttl=64 time=0.371 ms
64 bytes from 192.168.183.131: icmp_seq=81 ttl=64 time=0.263 ms
64 bytes from 192.168.183.131: icmp_seq=82 ttl=64 time=50.1 ms
64 bytes from 192.168.183.131: icmp_seq=83 ttl=64 time=0.426 ms
64 bytes from 192.168.183.131: icmp_seq=84 ttl=64 time=0.385 ms
64 bytes from 192.168.183.131: icmp_seq=85 ttl=64 time=0.401 ms
64 bytes from 192.168.183.131: icmp_seq=86 ttl=64 time=0.347 ms
64 bytes from 192.168.183.131: icmp_seq=87 ttl=64 time=0.334 ms

8. kill 进程后，这个fd就没有了。

[root@nicole-node1 fd]# cp 1 ~/nicole.test && kill 65694
[root@nicole-node1 fd]# ls
[1]+  Terminated              ping 192.168.183.131 > ~/test.nicole  (wd: ~)
(wd now: /proc/65694/fd)
[root@nicole-node1 fd]# ls