这里是通过lsof工具恢复误删除的文件
注意:当文件被删除后停止一切的写入操作
本次是删除了一个目录/var/lib/mysql-cluster
[root@mysql-manager lib]# lsof | grep delete |grep /var/lib/mysql-cluster |sort -nrk 7|more
ndb_mgmd 1072 root 3u REG 253,0 562283 202248914 /var/lib/mysql-cluster/ndb_1_cluster.log (deleted)
ndb_mgmd 1072 1401 root cwd DIR 253,0 6 202248913 /var/lib/mysql-cluster (deleted)
ndb_mgmd 1072 1401 root 5uW REG 253,0 4 202248917 /var/lib/mysql-cluster/ndb_1.pid (deleted)
ndb_mgmd 1072 1401 root 3u REG 253,0 562283 202248914 /var/lib/mysql-cluster/ndb_1_cluster.log (deleted)
ndb_mgmd 1072 1401 root 2w REG 253,0 600 202248915 /var/lib/mysql-cluster/ndb_1_out.log (deleted)
ndb_mgmd 1072 1401 root 1w REG 253,0 600 202248915 /var/lib/mysql-cluster/ndb_1_out.log (deleted)
ndb_mgmd 1072 1400 root cwd DIR 253,0 6 202248913 /var/lib/mysql-cluster (deleted)
ndb_mgmd 1072 1400 root 5uW REG 253,0 4 202248917 /var/lib/mysql-cluster/ndb_1.pid (deleted)
ndb_mgmd 1072 1400 root 3u REG 253,0 562283 202248914 /var/lib/mysql-cluster/ndb_1_cluster.log (deleted)
ndb_mgmd 1072 1400 root 2w REG 253,0 600 202248915 /var/lib/mysql-cluster/ndb_1_out.log (deleted)
ndb_mgmd 1072 1400 root 1w REG 253,0 600 202248915 /var/lib/mysql-cluster/ndb_1_out.log (deleted)
这里的进程是1072,进入指定的进程查看
[root@mysql-manager data]# cd /proc/1072/fd
[root@mysql-manager fd]# ll
总用量 0
lr-x------ 1 root root 64 5月 27 08:22 0 -> /dev/null
l-wx------ 1 root root 64 5月 27 08:22 1 -> /var/lib/mysql-cluster/ndb_1_out.log (deleted)
lrwx------ 1 root root 64 5月 27 08:22 10 -> socket:[18878]
lrwx------ 1 root root 64 5月 27 08:22 11 -> socket:[19893]
lrwx------ 1 root root 64 5月 27 08:22 12 -> socket:[19894]
lrwx------ 1 root root 64 5月 27 08:22 13 -> socket:[19153]
lrwx------ 1 root root 64 5月 27 08:22 14 -> socket:[19154]
lrwx------ 1 root root 64 5月 27 08:22 15 -> socket:[19945]
lrwx------ 1 root root 64 5月 27 08:22 16 -> socket:[19946]
l-wx------ 1 root root 64 5月 27 08:22 2 -> /var/lib/mysql-cluster/ndb_1_out.log (deleted)
lrwx------ 1 root root 64 5月 27 08:22 3 -> /var/lib/mysql-cluster/ndb_1_cluster.log (deleted)
lrwx------ 1 root root 64 5月 27 08:22 4 -> anon_inode:[eventpoll]
lrwx------ 1 root root 64 5月 27 08:22 5 -> /var/lib/mysql-cluster/ndb_1.pid (deleted)
lrwx------ 1 root root 64 5月 27 08:22 6 -> socket:[18869]
lrwx------ 1 root root 64 5月 27 08:22 7 -> socket:[18870]
lrwx------ 1 root root 64 5月 27 08:22 8 -> socket:[18872]
lrwx------ 1 root root 64 5月 27 08:22 9 -> socket:[18873]
这里我们看到文件夹下实际有3个文件需要恢复
[root@mysql-manager fd]# cp 1 /root/ndb_1_out.log
[root@mysql-manager fd]# cp 3 /root/ndb_1_cluster.log
[root@mysql-manager fd]# cp 5 /root/ndb_1.pid
将恢复的文件还原到原来的文件夹中
[root@mysql-manager fd]# mkdir /var/lib/mysql-cluster/
[root@mysql-manager fd]# mv /root/ndb_1* /var/lib/mysql-cluster/