Is it possible to recover the timeline server log files when it gets deteleted by the user?

[#1]

One of my team member has deleted the timeline server log file in the production Hadoop cluster which has been available in the following path : /var/log/Hadoop-yarn/yarn/.

he has used the following command rm yarn-yarn-timelineserver-hn0-myprha.log in the head node 0 of the Hadoop cluster.

we wanted to recover the log file back to the same path.

can anybody help on this case?

Thanks in Advance!

[#2]

@Sugumar Srinivasan

My question is do you have something of value that you want to retrieve for that lost log? if so try the method below I had it documented but it has never occurred to me to use it

Else the file will be recreated when that service restarts

Recovery

If a running program still has the deleted file open, you can recover the file through the open file descriptor in /proc/[pid]/fd/[num]. To determine if this is the case, you can attempt the following:

$ lsof | grep "/var/log/Hadoop-yarn/yarn/yarn-yarn-timelineserver-hn0-myprha.log"

If the above gives an output of the form:

progname 5383 user 22r REG 8,1 16791251 265368 /path/to/file               

Take note of the PID in the second column, and the file descriptor number in the fourth column. Using this information you can recover the file by issuing the command:

$ cp /proc/5383/fd/22 /path/to/restored/file

HTH