I have used GDB to look at a process and get a dump of particular run-time data structures, which is usually enough to reconstruct a config file. Config data s

I have used GDB to look at a process and get a dump of particular run-time data structures, which is usually enough to reconstruct a config file. Config data structures usually don't change while a process is running. Often they are just values in global variables. If you have the executable file for the process, it may be possible to run that with trial config files, and then compare the GDB dump from the running service with the GDB dump from a trial config, to compare the relevant data structures. That can provide more confidence than just figuring out what the config ought to be. Getting a GDB dump of the running service will be quite disruptive if it's done manually, but that might not matter. It will depend on whether the service is heavily used or if it's only doing something occasionally. If the service is in constant use, it could make sense to automate GDB so it captures the config data structures quickly then safely detaches, and only briefly pauses the service. Alternatively, if even automated GDB is too disruptive or difficult to use, or if the ptrace() syscalls used by GDB might cause a problem, it is often possible to capture a memory dump of the running process without affecting the process much, via /proc/PID/mem on Linux. If necessary, write a tool in C to walk the heap by reading it from /proc/PID/mem to reconstruct the config data structures that way. (All the above assumes Linux.)