I was tailing a log file overnight, which is written to by a docker container that mounts a file under /var/log on the host. What I found this morning is log lines are randomly in only either tail's console output or the underlying file it was meant to be tailing, not in both as you'd expect.
So e.g. the tail of /var/log/my/file might have printed:
10:01: Event 1
10:03: Event 3
But all that's in /var/log/my/file when viewed in e.g. less is:
10:02: Event 2
Both the tail and direct file viewing were performed on the host.
The file would have rolled overnight (on the host) while the tail was running, prior to the timestamps above.
Has anyone seen this behaviour before or able to explain it?
