continuous display of log files (better tail -f)

All good sysadmins know about using tail -f to follow a log file. I use this all the time to follow /var/log/messages and my gluster logs in particular. Maybe everyone already knows this, but it deserves a PSA: after a certain amount of time (~days) it seems that new messages don’t appear!

What happens by default is that tail -f follows the file descriptor, not the file name, so when your log files get rotated, the file descriptor still points to the (now renamed) file which no longer gets updates any more.

The solution is to get tail to follow the file name you’re interested in:

tail --follow=name /var/log/messages

EDIT: Fortunately there is a shorter way of running this too, you can use:

tail -F

on any up to date version of tail to get the same result. This adds in –retry to the –folllow=name argument.

Happy hacking!

James

 

Advertisements

7 thoughts on “continuous display of log files (better tail -f)

  1. Pingback: Clustering virtual machines with rgmanager and clusvcadm | The Technical Blog of James

  2. Nice post! After playing around with this a bit, I started looking around for alternatives that had more extensive features. BareTail and Vim both seem promising, depending on your needs:

    http://bit.ly/UvaCGq

    Do you see any value in third-party tools like these?

  3. The description from ‘tail -h’. Watch out if you have log rotation on.

    “With –follow (-f), tail defaults to following the file descriptor, which
    means that even if a tail’ed file is renamed, tail will continue to track
    its end. This default behavior is not desirable when you really want to
    track the actual name of the file, not the file descriptor (e.g., log
    rotation). Use –follow=name in that case. That causes tail to track the
    named file by reopening it periodically to see if it has been removed and
    recreated by some other program.”

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s