Search code examples
nginxnginx-config

Get content removed file nginx config when haven't restarted nginx

I accidentally deleted the nginx configuration file named 'content' without an extension. I haven't restarted nginx yet. I tried using nginx -T but it didn't reload the content of the deleted file. I've also tried various recovery tools like photorec and testdisk, but I still haven't been able to recover it. I use centos 7 and nginx/1.20.1

Solution

  • I find an anwser https://gist.github.com/widnyana/e0cb041854b6e0c9e0d823b37994d343. It saves my life.

    run command ps aux | grep nginx

    nginx     48322  0.2  0.5 485800 47808 ?        S    Nov07   2:50 php-fpm: pool www
nginx     49256  0.2  0.6 483544 48408 ?        S    Nov07   2:56 php-fpm: pool www
nginx     60861  0.1  0.4 474252 37800 ?        S    Nov07   2:17 php-fpm: pool www
nginx     66194  0.1  0.7 499860 61656 ?        S    Nov07   1:59 php-fpm: pool www
nginx     70112  0.1  0.4 468324 32128 ?        S    Nov07   1:21 php-fpm: pool www
root      83931  0.0  0.0 112816   980 pts/0    S+   08:51   0:00 grep --color=auto nginx
nginx     91126  0.0  0.4 470236 33640 ?        S    Nov07   0:22 php-fpm: pool www
nginx     91158  0.0  0.5 478428 40708 ?        S    Nov07   0:22 php-fpm: pool www
nginx     91252  0.0  0.4 470232 32304 ?        S    Nov07   0:20 php-fpm: pool www
root      92768  0.0  0.0  39448  1156 ?        Ss   Nov05   0:00 nginx: master process /usr/sbin/nginx
nginx     92769  0.0  0.0  40248  2756 ?        S    Nov05   0:13 nginx: worker process
nginx     92770  0.0  0.0  40228  2776 ?        S    Nov05   0:13 nginx: worker process
nginx     92771  0.0  0.0  40232  2784 ?        S    Nov05   0:17 nginx: worker process
nginx     92772  0.0  0.0  39964  2772 ?        S    Nov05   0:23 nginx: worker process
nginx     92804  0.0  0.3 468188 31684 ?        S    Nov07   0:18 php-fpm: pool www
nginx     96330  0.0  0.4 470236 32340 ?        S    Nov07   0:09 php-fpm: pool www

    you need to install gdb (GNU Debugger)

    create dump.sh file with content

    # Set pid of nginx master process here
pid=92768

# generate gdb commands from the process's memory mappings using awk
cat /proc/$pid/maps | awk '$6 !~ "^/" {split ($1,addrs,"-"); print "dump memory mem_" addrs[1] " 0x" addrs[1] " 0x" addrs[2] ;}END{print "quit"}' > gdb-commands

# use gdb with the -x option to dump these memory regions to mem_* files
gdb -p $pid -x gdb-commands

# look for some (any) nginx.conf text
grep worker_connections mem_*
grep server_name mem_*

    run ./dump.sh You should get something like

    [Inferior 1 (process 92768) detached]
Binary file mem_55a3d0e41000 matches
Binary file mem_55a3d0e41000 matches
Binary file mem_7ffe28060000 matches

    . Open these files in editor, search for config (e.g. "worker_connections" directive), copy&paste. Profit!

    Update: This method isn't entirely reliable. It's based on assumption that nginx process will read configuration and don't overwrite/reuse this memory area later. Master nginx process gives us best chances for that I guess.