3

I have a nohup process running on my FreeBSD 8.4 box. Initially I was looking at nohup console messages output through

tail -f nohup.out

But I accidentally deleted nohup.out file. How can I access the console messages now ?

1 Answer 1

2

Yes, though the file is still there for as long as a process keeps it open, because it was unlink-ed, it is no longer accessible.

If you need to continue seeing the messages as they are generated, you can enable ktrace on the process, that generates them:

% ktrace -p PID
% kdump -l

The above will list all system-calls made by the process, however, not just writes to stdout and stderr, so it may be a bit overwhelming and/or require additional filtering to get only, what you wish to see.

If you want a copy of the file, you can use one of the general-purpose utilities such as tsk_recover from the sysutils/sleuthkit port. The usual wisdom of not writing to the filesystem containing the accidentally-deleted files, that you wish to restore, does not apply, because you still have a process keeping the file open.

However, the recovery will create a copy of the deleted file -- anything written to it by the same process later will not be in the copy.

Sorry, I can not think of anything else... On Solaris I was once able to restore a deleted file, that was still-open by a process by going into /proc/PID/fd/..., but procfs on FreeBSD does not offer such functionality...

According to this answer, the /proc/PID/fd method would also work on Linux, but FreeBSD's linprocfs does not offer the feature either. A shame, really...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .