60

I have some logs being generated using a timed rotating file logger. This logs to a file called tool.log, and at midnight, moves this to tool.log.<date> and starts a new tool.log.

I have a tail -f tool.log running on the machine to keep an eye on the logs, but at midnight, when tool.log is renamed to tool.log.<date>, tail continues to watch the renamed file.

What I'm hoping for is a tool that is similar to tail, but will continue to monitor the file named tool.log, rather than following the inode.

Does something like this exist? If not, I can write my own in Python for this purpose.

90

Some implementations of tail have an option for this; here's the description from the man page for GNU tail:

-F
same as --follow=name --retry

-f, --follow[={name|descriptor}]
output appended data as the file grows; -f, --follow, and --follow=descriptor are equivalent

--retry
keep trying to open a file even when it is or becomes inaccessible; useful when following by name, i.e., with --follow=name

As this option isn't specified by POSIX, you can't depend on it everywhere. Some known implementations:

  • GNU - has -F as described above
  • Mac OS X, FreeBSD and NetBSD - have a similar -F option with the same effect
  • OpenBSD - -f is enough (if the file is replaced (i.e., the inode number changes), tail will reopen the file and continue)
  • Solaris - no equivalent
  • Busybox - -F is available in recent versions, but must be compiled with ENABLE_FEATURE_FANCY_TAIL (it's not compiled-in by default)
55

Alternative is tail -F command.

The -F option implies --follow=name with --retry option, so tail is watching your file even if it has been deleted and created again.

5

Since you have asked for alternative:

The less utility could be an alternative for tail -F.

It will have to be run as follows: less --follow-name filename.log and press Shift + F.

This will give you same results as tail -F.

  • Thanks. I was only after an alternative because I was unaware of tail -F. Always good to know options though. – Hugh May 15 '16 at 2:39
4

Another alternative would be to use the watch command, which will repeat any command every n seconds, every 2 seconds in this example:

watch -n2 "tail tool.log"

Use Ctrl+C to quit the command when you're finished viewing the log.

  • 1
    This seems like it would create a lot of duplicate messages if the log scrolled slower than the refresh timer, and would miss some messages if it scrolled faster. – Bobson Mar 31 '16 at 17:51
  • 3
    Watch takes over the whole screen, so it wouldn't duplicate messages, but it would remove the ability to scroll back. – Hugh Mar 31 '16 at 20:15
3

lnav is another fantastic tool that follows the filename.

You can also point it to a directory and it will tail all the files in that directory, in addition to all kinds of other neat features.

  • I've found it doesn't handle truncated and/or renamed rotated logs (I'm not sure which is upsetting it in my particular case) so the logs appear to stop at midnight unless I restart lnav. Am I missing some obvious switch or technique for it I wonder as this seems like something it should take in its stride? – Stuart Hickinbottom Jan 20 '17 at 7:57
  • It depends on how the file is truncated. If you pass the -r flag to lnav it will reload the filename (and load any previously rotated out logs) – Wayne Werner Jan 20 '17 at 16:12
1

I'm not sure if multitail will handle your specific case, but I bet it does. multitail does pretty much everything you could want tail to do.

https://en.wikipedia.org/wiki/MultiTail

  • 1
    Yes it will -- multitail -f <name1> -f <name2> -f <name3> .... This example shows following several files simultaneously, which will be shown in separate windows. – Stuart Hickinbottom Jan 20 '17 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.