In an interview they asked me this question.
There was an sh file that is already running, but it has been deleted since starting the execution.
They want me to find the process and read the file.
I managed to find the process with
ps -ef | grep test.sh
and tried to read it by using
cat /proc/PID/cmdline test.sh
but it says
no such file or directory
I didn't know what I should do next so I had to skip this.
Maybe it was an easy question but that was really a good question for me and I really want to know the answer. Can you guys help?
Best Answer
where {pid} is the id of your process and
/tmp/file
will have its contents. Use another location and name if you want to preserve it.lsof
should show the fd.lsof
is likely also going to show "deleted" on the line so you cangrep
that too.lsof -nP +L1
will list all files with less than 1 link, a file deleted will have 0. Add a| grep {pid}
to search for just your PID.lsof -p 22664 | sed -E '$!d;s/.*\s([0-9]+)[a-z]\s.*/\1/'
to just get the fd.less
,cat
orcp
too. I grew up ontail
:)