有进程的文件被删恢复过程

手动测试一个有进程占用的文件被删除后的整个恢复过程。

写个测试脚本

cat > test.sh <<EOF
#!/bin/bash

while true
do
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
        echo `date "+%F %T"` "hello world,I am running..."
done
EOF

启动脚本

# 开启多并发，加快日志文件的增长，后续测试清空文件对磁盘占用的变化
for i in `seq 1 100`
do
	nohup sh test.sh &> log.log &
done

观察日志增长和磁盘占用变化

# 查看日志占用空间的变化
ll -h log.log
df -h 

# 清空日志，释放磁盘空间
> log.log
ll -h log.log
df -h

删除日志文件，手动进行恢复

rm -f log.log
# 查看有哪些进程占用的文件被删除了
find /proc/*/fd -ls |grep '(deleted)'

# 将文件内容恢复，并重定向后续日志
nohup tail -f -n 99999999999999 /proc/1234/fd/1 &> log.log &
tail -f log.log

# 常用命令
lsof -p $pid
lsof log.log
ps -ef |grep $pid