linux lsof误删日志,Linux下使用lsof恢复删除的文件

使用lsof删除恢复的文件

模拟lsof恢复删除的文件(tools.dbf)：

Solaris 9 + lsof 4.77 + oracle 8.1.7

1.数据文件由dbwr进程打开。

bash-2.05# ps -ef | grep ora_ | grep 817          (其中test表示sid)

oracle81710 15:56:30 ?0:00 ora_pmon_test817

oracle81910 15:56:30 ?0:00 ora_dbw0_test817

oracle82110 15:56:30 ?0:00 ora_lgwr_test817

oracle82310 15:56:30 ?0:00 ora_ckpt_test817

oracle82510 15:56:31 ?0:01 ora_smon_test817

oracle82710 15:56:31 ?0:00 ora_reco_test817

oracle82910 15:56:31 ?0:00 ora_snp0_test817

oracle83110 15:56:31 ?0:00 ora_snp1_test817

oracle83310 15:56:31 ?0:00 ora_snp2_test817

oracle83510 15:56:31 ?0:00 ora_snp3_test817

oracle83710 15:56:31 ?0:00 ora_s000_test817

oracle83910 15:56:31 ?0:00 ora_d000_test817

oracle84110 15:56:31 ?0:00 ora_arc0_test817

2.列出dbwr进程打开的数据文件

bash-2.05# lsof -a -p 819 -d ^txt | egrep "COMMAND|dbf"

COMMAND PIDUSERFDTYPE DEVICESIZE/OFFNODE NAME

oracle819 oracle *200uW VREG32,41049395222545 /u01/oracle/oradata/test817/garychen01.dbf

oracle819 oracle *201uW VREG32,4 10486579222544 /u01/oracle/oradata/test817/test01.dbf

oracle819 oracle *202uW VREG32,48808857622563 /u01/oracle/oradata/test817/drsys01.dbf

oracle819 oracle *203uW VREG32,45663129622560 /u01/oracle/oradata/test817/indx01.dbf

oracle819 oracle *204uW VREG32,4 10906009622559 /u01/oracle/oradata/test817/users01.dbf

oracle819 oracle *205uW VREG32,47131136022558 /u01/oracle/oradata/test817/temp01.dbf

oracle819 oracle *206uW VREG32,4 54107340822557 /u01/oracle/oradata/test817/rbs01.dbf

oracle819 oracle *207uW VREG32,4839680022556 /u01/oracle/oradata/test817/tools01.dbf

oracle819 oracle *208uW VREG32,4 28312371222555 /u01/oracle/oradata/test817/system01.dbf

3.删除tools.dbf数据文件

bash-2.05# rm /u01/oracle/oradata/test817/tools01.dbf

4.在Solaris中，删除的文件将显示文件所在的磁盘的名称

bash-2.05# lsof -a -p 819 -d ^txt

COMMAND PIDUSERFDTYPE DEVICESIZE/OFFNODE NAME

oracle819 oraclecwdVDIR32,11512 158092 /u03/oracle/product/8.1.7/dbs

oracle819 oracle0rVCHR13,20t0 281623 /devices/pseudo/mm@0:null

oracle819 oracle1rVCHR13,20t0 281623 /devices/pseudo/mm@0:null

oracle819 oracle2rVCHR13,20t0 281623 /devices/pseudo/mm@0:null

oracle819 oracle3rVCHR13,20t0 281623 /devices/pseudo/mm@0:null

oracle819 oracle4rVCHR13,20t0 281623 /devices/pseudo/mm@0:null

oracle819 oracle5rVCHR13,20t0 281623 /devices/pseudo/mm@0:null

oracle819 oracle6wVREG32,1143794 171624 /u03/oracle/admin/test817/bdump/alert_test817.log

oracle819 oracle7rVCHR24,30t0 281702 /devices/pseudo/pts@0:3->ttcompat->ldterm->ptem->pts

oracle819 oracle 8wVREG32,1143794 171624 /u03/oracle/admin/test817/bdump/alert_test817.log

oracle819 oracle9rDOOR268,00t058 /var/run (swap) (door to nscd[269])

oracle819 oracle10rVREG32,1135891284962 /u03/oracle/product/8.1.7/rdbms/mesg/oraus.msb

oracle819 oracle11uVREG32,111124 171764 /u03/oracle/product/8.1.7/rdbms/audit/ora_815.aud

oracle819 oracle12uR VREG32,1124 158548 /u03/oracle/product/8.1.7/dbs/lkTEST817

oracle819 oracle *200uW VREG32,41049395222545 /u01/oracle/oradata/test817/garychen01.dbf

oracle819 oracle *201uW VREG32,4 10486579222544 /u01/oracle/oradata/test817/test01.dbf

oracle819 oracle *202uW VREG32,48808857622563 /u01/oracle/oradata/test817/drsys01.dbf

oracle819 oracle *203uW VREG32,45663129622560 /u01/oracle/oradata/test817/indx01.dbf

oracle819 oracle *204uW VREG32,4 10906009622559 /u01/oracle/oradata/test817/users01.dbf

oracle819 oracle *205uW VREG32,47131136022558 /u01/oracle/oradata/test817/temp01.dbf

oracle819 oracle *206uW VREG32,4 54107340822557 /u01/oracle/oradata/test817/rbs01.dbf

oracle819 oracle *207uW VREG32,4839680022556 /u01 (/dev/dsk/c1t0d0s4)

oracle819 oracle *208uW VREG32,4 28312371222555 /u01/oracle/oradata/test817/system01.dbf

oracle819 oracle *209uVREG32,4443187222551 /u01/oracle/oradata/test817/control03.ctl

oracle819 oracle *210uVREG32,4443187222550 /u01/oracle/oradata/test817/control02.ctl

oracle819 oracle *211uVREG32,4443187222549 /u01/oracle/oradata/test817/control01.ctl

5.查看/proc文件系统

Cd /proc/819/fd/就可以得到所要查找的数据

bash-2.05# ls /proc/819/fd/*207

/proc/819/fd/26207

cat /proc/819/fd/26207 >/u01/oracle/oradata/test817/tools01.dbf

chown oracle:dba /u01/oracle/oradata/test817/tools01.dbf

6.验证文件已经恢复了。

Sqlplus> alter system checkpoint;