There are times when you may unintentionally delete a file which is being written to.
When this occurs it will leave an Open Filehandle.
In Linux open filehandles may be viewed via the ‘lsof’ command.
# lsof +L1
In the following example here was the situation.
- I executed a script using nohup
(i.e. “nohup vmstore-tnt.sh &”) - File /root/nohup.out was being written to.
- I deleted the file nohup.out
- Thus this left an open filehandle.
$ lsof +L1 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME vmstore-t 57520 root 1w REG 252,1 26136 0 1671175 /root/nohup.out (deleted) vmstore-t 57520 root 2w REG 252,1 26136 0 1671175 /root/nohup.out (deleted)
Merely recreating the file via (touch /root/nohup.out) will not restore the file
To view the contents of the file that was deleted, you have to locate the Process ID (PID) from the above ‘lsof’ output.
(The above shows the PID as 57520)
Now wee can look for the fd (file descriptors) in Linux /proc pseudo filesystem by looking in /proc/<pid>/fd
# ls /proc/57520/fd 0 1 2 255
| NUMBER | MEANING |
|---|---|
| 0 | Standard Input |
| 1 | Standard Output |
| 2 | Standard Error |
| 255 | The File |
*note: There may be additional File Descriptor Numbers which are beyond the scope of this document.
Now, to view the real-time file progress you may issue
# cat /proc/57520/fd/1
To view any standard error real-time you may view
# cat /proc/57520/fd/2
If you wish to temporarily restore the standard output of the file so you can monitor the output, you may create a ‘soft’ link via:
# ln -s /proc/57520/fd/1 /root/nohup.out
You may verify the link via
$ ls -Al nohup.out lrwxrwxrwx 1 root root 16 May 1 15:02 nohup.out -> /proc/57520/fd/1
*note: Once the process stops you will have to delete the soft link!
When you try to view the contents you will see
# tail nohup.out tail: cannot open `nohup.out' for reading: No such file or directory
Therefore remove the file
# rm nohup.out
We should no longer see any open files
# lsof +L1 #