Grabbing data written to unlinked file
Dear All, I foolishly rm'd a file that a lengthy process still has open for writing (although it has yet to write any data.) That is, the output of lsof -p 26733 includes gnuplot 26733 dan 4w REG 253,0 0 6802530 /home/dan/Natural_Sciences/mushy/twentyfirstplot.dat (deleted) It would be really valuable to be able to save the data that process 26733 eventually writes to this file. Any ideas, please? -- Thanks, Dan Hatton
Dan Hatton wrote:
It would be really valuable to be able to save the data that process 26733 eventually writes to this file. Any ideas, please?
I assume at this point you've paused that process so that it doesn't complete while you're trying to solve this? -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0845 45 89 555 Registered in England (0456 0902) at 13 Clarke Rd, Milton Keynes, MK1 1LG
Oops, forgot to paste the link to the how-to: http://www.linux.com/articles/58142?tid=47 -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0845 45 89 555 Registered in England (0456 0902) at 13 Clarke Rd, Milton Keynes, MK1 1LG
On Fri, 8 Feb 2008, Mark Rogers wrote:
Oops, forgot to paste the link to the how-to: http://www.linux.com/articles/58142?tid=47
Thanks Mark. I followed the instructions linked above, but I've got a feeling all they did was save a snapshot of the file as it was when I followed the instructions, whereas what I want is a snapshot of its state just before the process that's going to write it exits. But the above URL did give me the clue that the symlink in /proc exists. Thanks to Phil as well: time-critical unmounting of a filesystem sounds scary, but I've put a pin in it for later. What I've done for now is written a little perl script that opens the symlink in /proc for reading, then enters an endless loop. That should preserve my data until I can open them in a text editor and copy and paste them somewhere safe, right? -- Thanks again, Dan
Dan Hatton wrote:
Thanks Mark. I followed the instructions linked above, but I've got a feeling all they did was save a snapshot of the file as it was when I followed the instructions, whereas what I want is a snapshot of its state just before the process that's going to write it exits. But the above URL did give me the clue that the symlink in /proc exists.
Presumably, now you have access to the file via /proc, you could "tail -f" it so that you have another process holding it open. Then you can copy it after the first process finishes, but before killing the tail. Or just tail -f /proc/blah/blah > ~/copy-of-file.txt .. and when the original file has gone you'll have a copy anyway in copy-of-file.txt
What I've done for now is written a little perl script that opens the symlink in /proc for reading, then enters an endless loop. That should preserve my data until I can open them in a text editor and copy and paste them somewhere safe, right?
Ought to work, although I'd like to test it before committing to it :-) -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0845 45 89 555 Registered in England (0456 0902) at 13 Clarke Rd, Milton Keynes, MK1 1LG
On Fri, 2008-02-08 at 10:53 +0000, Dan Hatton wrote:
Dear All,
I foolishly rm'd a file that a lengthy process still has open for writing (although it has yet to write any data.) That is, the output of lsof -p 26733 includes
gnuplot 26733 dan 4w REG 253,0 0 6802530 /home/dan/Natural_Sciences/mushy/twentyfirstplot.dat (deleted)
It would be really valuable to be able to save the data that process 26733 eventually writes to this file. Any ideas, please?
Hi Dan, First you need to note the starting inode number from lsof (6802530), then you can re-create the missing directory entry using debugfs (as root). After which you can ritually slap yourself :) This page explains how to drive debugfs to create a directory link. http://tldp.org/HOWTO/Ext2fs-Undeletion-11.html Phil.
On 08-Feb-08 10:53:59, Dan Hatton wrote:
Dear All,
I foolishly rm'd a file that a lengthy process still has open for writing (although it has yet to write any data.) That is, the output of lsof -p 26733 includes
gnuplot 26733 dan 4w REG 253,0 0 6802530 /home/dan/Natural_Sciences/mushy/twentyfirstplot.dat (deleted)
It would be really valuable to be able to save the data that process 26733 eventually writes to this file. Any ideas, please?
Thanks,
Dan Hatton
Not speaking authoritatively here, but it might just work! I just experimented with a 'vim' session, opening a new file: vim temp.txt I entered the text "this is line 1", and saved it (:w). Then, in another window, I deleted temp.txt and .temp.txt.swp, thus removing vim's "workspace" from the directory. Then, back in vim, I entered another line "this is line 2" and again saved with :w I find that temp.txt contains both lines (though .temp.txt.swp is now nowhere to be seen). And I can continue adding lines recreating temp.txt each time. However, it may well be that whenever vim receives a ":w" it opens the file for writing, writes everything to it, and closes it again. So the above experiment proves nothing. But when I identify the pid of the vim session (4636) and do as you did: lsof -p 4636 the last line of the output is: vim 4636 ted 3u REG 3,1 12288 294883 /home/ted/.temp.txt.swp (deleted) very similar to yours. So I guess it depends on how gnuplot handles its open files. It could be that once the file is deleted, its internal file handle no longer points to anything, so nothing would happen (except maybe gnuplot would exit). Good luck! (And I hope someone else really knows the answer). Ted. -------------------------------------------------------------------- E-Mail: (Ted Harding) <Ted.Harding@manchester.ac.uk> Fax-to-email: +44 (0)870 094 0861 Date: 08-Feb-08 Time: 11:26:04 ------------------------------ XFMail ------------------------------
participants (4)
-
Dan Hatton -
Mark Rogers -
Phil Ashby -
Ted.Harding＠manchester.ac.uk