Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a process on host #1 which is periodically appending to a file - foo.log.

I have a process on host #2 which has access to foo.log via a samba mount. And I invoke tail -F on that file to observe its output in real time.

Some lines are "lost" or dropped by tail -F.

An investigation with strace reveals that some of the reads() come back with a set of null bytes.

nanosleep({1, 0}, NULL)                 = 0                                               
fstat(3, {st_mode=S_IFREG|0660, st_size=54526947, ...}) = 0                               
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 8192) = 630
read(3, "", 8192)                       = 0    

Of course, some lines are correctly returned so its not always these blocks of null.

Also, the same strace command invoked directly on host #1's file system that is hosting foo.log never displays this null byte read block from strace.

It's as though the samba server on host #1 can see the file size change, but is prevented from seeing the contents in real time. If samba waited just a second and tried again, I bet the contents would be there.

Is there a way to enable samba to allow for tail -F on files in real time without dropping lines?

share|improve this question

In short, no, there is no way to force tail to show you every line posted to a mounted file system.

I don't know the inner workings of tail (I haven't looked at the source lately) but if I remember correctly, it constantly seeks to the end of the file and when the EOF moves then it reports the content from last seek to EOF.

This sounds like it should work as expected but because of the mounted nature of your file system EOF changes are not always immediately apparent. Buffered writes are the underlying cause (again, if I remember correctly).

If you must get every line then you must get off a mount.

share|improve this answer
You could be right, but here's what it looks like to me. Tail appears to do a stat on the file to get the file size and then its reading the new bytes that have appeared since the last stat. This is from the samba process. Even if host #1 is caching, the samba process (thanks to linux) should be pulling data from that cache. So I keep thinking it should still see those new lines. – Eric Johnson Sep 19 '13 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .