[root@han ~]# lsof |grep /var/log/messages
abrt-watc 6164 root 4r REG 8,2464667134396728 /var/log/messages
rsyslogd 129797 root 14w REG 8,2464667134396728 /var/log/messages
in:imjour 129797129799 root 14w REG 8,2464667134396728 /var/log/messages
in:imudp 129797129800 root 14w REG 8,2464667134396728 /var/log/messages
in:imfile 129797129801 root 14w REG 8,2464667134396728 /var/log/messages
rs:main 129797129802 root 14w REG 8,2464667134396728 /var/log/messages
[root@han ~]# rm -rf /var/log/messages[root@han ~]# lsof |grep /var/log/messages
abrt-watc 6164 root 4r REG 8,2464731134396728 /var/log/messages (deleted)
rsyslogd 129797 root 14w REG 8,2464731134396728 /var/log/messages (deleted)
in:imjour 129797129799 root 14w REG 8,2464731134396728 /var/log/messages (deleted)
in:imudp 129797129800 root 14w REG 8,2464731134396728 /var/log/messages (deleted)
in:imfile 129797129801 root 14w REG 8,2464731134396728 /var/log/messages (deleted)
rs:main 129797129802 root 14w REG 8,2464731134396728 /var/log/messages (deleted)[root@han ~]# ll /proc/129797/fd
total 0
lr-x------ 1 root root 64 Aug 1513:57 0 -> /dev/null
l-wx------ 1 root root 64 Aug 1513:57 1 -> /dev/null
lr-x------ 1 root root 64 Aug 1513:57 10 -> /run/log/journal/7a51478eac9d45c3900fceeeb52bca93/system@a20e2c4eb0144c708ca33990f50849b4-0000000000002275-000601d0677c7db2.journal
lr-x------ 1 root root 64 Aug 1513:57 11 -> /run/log/journal/7a51478eac9d45c3900fceeeb52bca93/system@a20e2c4eb0144c708ca33990f50849b4-0000000000000001-000601aafb20b3d3.journal
lrwx------ 1 root root 64 Aug 1513:57 12 -> socket:[2641902]
lrwx------ 1 root root 64 Aug 1513:57 13 -> anon_inode:[eventpoll]
l-wx------ 1 root root 64 Aug 1513:57 14 -> /var/log/messages (deleted)
l-wx------ 1 root root 64 Aug 1513:57 15 -> /var/log/secure
l-wx------ 1 root root 64 Aug 1513:57 16 -> /var/log/cron
l-wx------ 1 root root 64 Aug 1513:57 2 -> /dev/null
lrwx------ 1 root root 64 Aug 1513:57 3 -> socket:[2641900]
lrwx------ 1 root root 64 Aug 1513:57 4 -> socket:[2641901]
lr-x------ 1 root root 64 Aug 1513:57 5 -> anon_inode:inotify
lrwx------ 1 root root 64 Aug 1513:57 6 -> socket:[2642944]
lr-x------ 1 root root 64 Aug 1513:57 7 -> /run/log/journal/7a51478eac9d45c3900fceeeb52bca93/system.journal
lr-x------ 1 root root 64 Aug 1513:57 8 -> /run/log/journal/7a51478eac9d45c3900fceeeb52bca93/system@a20e2c4eb0144c708ca33990f50849b4-000000000000610f-000602620e7938b5.journal
lr-x------ 1 root root 64 Aug 1513:57 9 -> /run/log/journal/7a51478eac9d45c3900fceeeb52bca93/system@a20e2c4eb0144c708ca33990f50849b4-00000000000041de-00060217a6820d92.journal
[root@han ~]# tail -5 /proc/129797/fd/14
Aug 1513:57:59 han rsyslogd: [origin software="rsyslogd"swVersion="8.24.0-34.el7" x-pid="129797" x-info="http://www.rsyslog.com"] start
Aug 1513:57:59 han rsyslogd: imfile: on startup file'/home/access.log' does not exist but is configured in static file monitor - this may indicate a misconfiguration. If the file appears at a later time, it will automatically be processed. Reason: No such file or directory [v8.24.0-34.el7]
Aug 1513:57:59 han systemd: Started System Logging Service.
Aug 1514:00:01 han systemd: Started Session 2732 of user root.
Aug 1514:01:01 han systemd: Started Session 2733 of user root.
[root@han ~]# tail -5 /proc/129797/fd/14
Aug 1513:57:59 han rsyslogd: [origin software="rsyslogd"swVersion="8.24.0-34.el7" x-pid="129797" x-info="http://www.rsyslog.com"] start
Aug 1513:57:59 han rsyslogd: imfile: on startup file'/home/access.log' does not exist but is configured in static file monitor - this may indicate a misconfiguration. If the file appears at a later time, it will automatically be processed. Reason: No such file or directory [v8.24.0-34.el7]
Aug 1513:57:59 han systemd: Started System Logging Service.
Aug 1514:00:01 han systemd: Started Session 2732 of user root.
Aug 1514:01:01 han systemd: Started Session 2733 of user root.
[root@han ~]# cat /proc/129797/fd/14 > /var/log/messages[root@han ~]# ll /var/log/messages
-rw-r--r-- 1 root root 464731 Aug 1514:03 /var/log/messages
[root@han ~]#