> # lsof |grep tftpboot
> in.tftpd 5281 root cwd DIR 251,0 0 2223873 /tftpboot (deleted)
Note that the line says "cwd" and "DIR". /tftpboot is not a file, but a directory. It is the current working directory of process 5281. Looks like this is a TFTP server process, started by inetd.
> # ls -la /proc/5281/fd/4
> lrwx------ 1 root root 64 2010-11-16 21:34 /proc/5281/fd/4 -> socket:[28748]
This indicates /proc/5281/fd/4 is a socket, not a regular file. It probably represents a network connection to a TFTP client, or perhaps a local connection to the syslog service. I'd say copying it would not be meaningful.
When the /tftpboot directory was deleted, one of two things may have happened: either the directory was empty, or the deletion command was given with the recursive option and it deleted all the files and sub-directories in the directory.
Rebuilding the directory itself is simple:
mkdir /tftpboot
But because there are no files currently open in the /tftpboot directory, any files that might have been there are now gone.
Look for backups if you want to recover them.
(I think a TFTP server would only hold regular files open while a TFTP GET or PUT operation is ongoing; it would have no reason to hold any files open beyond that.)
MK
MK
