Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I create a file named /home/martin/testfile.txt, open this file with less utility, delete /home/martin/testfile.txt file and restore it from file descriptor directory under the /proc/31148, where 31148 is the PID of the less utility, then lsof | grep testfile.txt still shows testfile.txt as deleted:

martin@potato:~$ echo test > testfile.txt
martin@potato:~$ ls -li ~/testfile.txt
247 -rw-r--r-- 1 martin martin 5 24. veebr 05:02 /home/martin/testfile.txt
martin@potato:~$ xterm -hold -e "less /home/martin/testfile.txt" &
[1] 31145
martin@potato:~$ lsof | grep testfile.txt
less      31148      martin    4r      REG                8,9        5        247 /home/martin/testfile.txt
martin@potato:~$ rm -v /home/martin/testfile.txt
removed `/home/martin/testfile.txt'
martin@potato:~$ lsof | grep testfile.txt
less      31148      martin    4r      REG                8,9        5        247 /home/martin/testfile.txt (deleted)
martin@potato:~$ cp -v /proc/31148/fd/4 /home/martin/testfile.txt
`/proc/31148/fd/4' -> `/home/martin/testfile.txt'
martin@potato:~$ ls -li ~/testfile.txt
263 -rw-r--r-- 1 martin martin 5 24. veebr 05:04 /home/martin/testfile.txt
martin@potato:~$ cat ~/testfile.txt
test
martin@potato:~$ lsof | grep testfile.txt
less      31148      martin    4r      REG                8,9        5        247 /home/martin/testfile.txt (deleted)
martin@potato:~$ 

Is this because testfile.txt got a new inode number? Or is there some other reason why lsof displays restored file as deleted?

share|improve this question
add comment

1 Answer

Yes, they are two different files. By copying (cp) the file from /proc, you are simply creating a new file with a new inode. You can test it with the statcommand -

[root@server2 tmp]# stat testfile.txt File: test.txt Size: 9 Blocks: 8 IO Block: 4096 regular file Device: 803h/2051d Inode: 3684616 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2013-02-23 19:01:14.000679872 -0800 Modify: 2013-02-23 19:01:14.000679872 -0800 Change: 2013-02-23 19:01:14.000679872 -0800

[root@server2 tmp]# stat testfile.txt File: test.txt Size: 9 Blocks: 8 IO Block: 4096 regular file Device: 803h/2051d Inode: 3684617 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2013-02-23 19:02:46.422854012 -0800 Modify: 2013-02-23 19:02:44.507799688 -0800 Change: 2013-02-23 19:02:44.507799688 -0800

share|improve this answer
    
Try using mv and observing the behaviour. mv is useful if you want/need to preserve everything about the file including the inode and excepting the name. You can then cp the mv'ed file back into place with the old name. –  davey Feb 24 '13 at 9:06
    
@davey But it isn't possible to move a file under /proc directory, is it? For example: if I execute martin@potato:~$ mv -f /proc/3688/fd/4 /home/martin/testfile.txt, I receive mv: cannot remove /proc/3688/fd/4': Permission denied` error. –  Martin Feb 24 '13 at 15:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.