Re: /var/log/* deleted

[SL Baur <steve@example.com>]

Stephen J Turnbull <turnbull@example.com> writes in tlug@example.com:

 ...
> Then you can try midnight commander; it's supposed to be able to
> undelete ext2 fs files.  if that doesn't work, you could go at the
> raw device with Python or Perl, extracting things that look like logs
> of connections.

The utility to use is debugfs.  If you can locate the correct inode,
you can manually reset the deleted flag.  After a later fsck, the file
will reappear in lost+found.  This will only work if the filesystem
has been relatively quiet since the file deletion, but it _will_ work
if you're lucky.