continuous display of log files (better tail -f)

Posted on by

All good sysadmins know about using tail -f to follow a log file. I use this all the time to follow /var/log/messages and my gluster logs in particular. Maybe everyone already knows this, but it deserves a PSA: after a certain amount of time (~days) it seems that new messages don’t appear!

What happens by default is that tail -f follows the file descriptor, not the file name, so when your log files get rotated, the file descriptor still points to the (now renamed) file which no longer gets updates any more.

The solution is to get tail to follow the file name you’re interested in:

tail --follow=name /var/log/messages

EDIT: Fortunately there is a shorter way of running this too, you can use:

tail -F

on any up to date version of tail to get the same result. This adds in –retry to the –folllow=name argument.

Happy hacking!

James

 

7 thoughts on “continuous display of log files (better tail -f)”

  2. Pingback: Clustering virtual machines with rgmanager and clusvcadm | The Technical Blog of James

  3. Nice post! After playing around with this a bit, I started looking around for alternatives that had more extensive features. BareTail and Vim both seem promising, depending on your needs:

    http://bit.ly/UvaCGq

    Do you see any value in third-party tools like these?

    Reply ↓

  4. The description from ‘tail -h’. Watch out if you have log rotation on.

    “With –follow (-f), tail defaults to following the file descriptor, which
    means that even if a tail’ed file is renamed, tail will continue to track
    its end. This default behavior is not desirable when you really want to
    track the actual name of the file, not the file descriptor (e.g., log
    rotation). Use –follow=name in that case. That causes tail to track the
    named file by reopening it periodically to see if it has been removed and
    recreated by some other program.”

    Reply ↓

Leave a comment