How to recovery log after delete in linux

Question:

The server is running Apache and by mistake one of the log files gets deleted via

rm kk.com-access_log

Without installing any 3rd party recovery tools how can you recover this file that your boss needs. Also assume that as soon as the log file was deleted that Apache was not restarted

Ans: So the simple answer is the deleted file is still held open by Apache so it can still be recovered in the /proc filesystem.

So here is how to get to it. 

For example I have a really small access_log

So let's remove it 

As we can see, there are access.log in httpd directory.

Now we will delete this access log file.   

So the file has been deleted now. So let’s find the process number for the main apache process. It will be owned by root

So we see that the pid for the main apache process is 15162. So now let’s list the file descriptors.

As you can see that is our file and it’s marked as deleted. So we can do

Now we can copy this file back to main directory.

Now you can enjoy...... your deleted file has been recovery.