Recover Deleted Nginx Logs on Linux Using lsof – Step‑by‑Step Guide

This article records a practice of using lsof to recover mistakenly deleted Linux files, specifically an Nginx access log.

Prerequisites

Ensure the Nginx process is running.

Delete the log file with rm -f /var/log/nginx/access.log.

Use lsof to help restore the log data.

Check Nginx status

[root@master10 ~]# systemctl status nginx

View the (now missing) log file

[root@master10 ~]# tail /var/log/nginx/access.log

Simulate accidental deletion

[root@master10 ~]# rm -f /var/log/nginx/access.log
[root@master10 ~]# tail /var/log/nginx/access.log
tail: cannot open ‘/var/log/nginx/access.log’ for reading: No such file or directory

Recover the log using lsof

1. Use lsof to find processes holding the deleted file:

[root@master10 ~]# lsof | grep /var/log/nginx/access.log
nginx     1439 root 5w REG 253,0 1524 17117944 /var/log/nginx/access.log (deleted)
nginx     1440 nginx 5w REG 253,0 1524 17117944 /var/log/nginx/access.log (deleted)
nginx     1441 nginx 5w REG 253,0 1524 17117944 /var/log/nginx/access.log (deleted)

The main Nginx process (PID 1439) still holds the file descriptor, so the file can be recovered.

Locate the file descriptor in /proc

2. Navigate to the process's file‑descriptor directory:

[root@master10 fd]# cd /proc/1439/fd
[root@master10 fd]# ll

Among the listed symbolic links, entry 5 points to /var/log/nginx/access.log (deleted).

Read and restore the deleted file

3. Display the contents of the descriptor and write them back to the original path:

[root@master10 fd]# cat 5 > /var/log/nginx/access.log
[root@master10 fd]# cat /var/log/nginx/access.log

The log file is now restored.

Original source: https://www.cnblogs.com/funlyp/p/18351218 (copyright belongs to the original author).