Yes, though the file is still there for as long as a process keeps it open, because it was unlink
-ed, it is no longer accessible.
If you need to continue seeing the messages as they are generated, you can enable ktrace
on the process, that generates them:
% ktrace -p PID % kdump -l
The above will list all system-calls made by the process, however, not just writes to stdout
and stderr
, so it may be a bit overwhelming and/or require additional filtering to get only, what you wish to see.
If you want a copy of the file, you can use one of the general-purpose utilities such as tsk_recover
from the sysutils/sleuthkit port. The usual wisdom of not writing to the filesystem containing the accidentally-deleted files, that you wish to restore, does not apply, because you still have a process keeping the file open.
However, the recovery will create a copy of the deleted file -- anything written to it by the same process later will not be in the copy.
Sorry, I can not think of anything else... On Solaris I was once able to restore a deleted file, that was still-open by a process by going into /proc/PID/fd/...
, but procfs on FreeBSD does not offer such functionality...
According to this answer, the /proc/PID/fd
method would also work on Linux, but FreeBSD's linprocfs does not offer the feature either. A shame, really...