6

I was watching a log file (logfile.log) with tail -f, and after a few minutes, the following message was written to the file:

tail: logfile.log: file truncated

I've never seen that before and I'm wonder why it happened, and how I can prevent it. The file is being written to by root (via a cronjob), and was created by another user.

It also seems that the cronjob is actually overwriting the logfile each time. I guess that this is probably the reason for the message I was seeing.

Edit Here's what the cronjob looks like:

* * * * * /usr/local/bin/ruby /home/web/script.rb > >/home/web/logfile.log 2>&1
bricker
  • 167
  • 1
  • 1
  • 7
  • 2
    It's around midnight on the east coast. Do you have any log rotation jobs running? – jgoldschrafe Oct 05 '12 at 04:56
  • Could be, but this logfile wouldn't be part of that (unless somehow the log rotation jobs are picking up every `*.log` file on the system?) Besides, our servers are in PST. – bricker Oct 05 '12 at 05:00
  • 1
    I dont know if its just a typo.. but shouldnt it be `..../script.rb >>/home/web/logfile.log` for it to propertly append? Your code seems to have a space between the double angle bracket – Karthik T Oct 05 '12 at 05:16
  • 1
    For the benefit of anyone else reading this question in the future who is seeing that error, but you know that the log file *is* being rotated/purged, you can avoid the error above using `tail -F` instead of `tail -f` – Bryan Oct 05 '12 at 07:22

3 Answers3

7

I dont know if its just a typo.. but shouldnt it be ..../script.rb >> /home/web/logfile.log for it to propertly append? Your code seems to have a space between the double angle bracket

I tried it just now on bash in mac, it prompted an error, perhaps some shells may just ignore the second angle arrow in this case

Karthik T
  • 186
  • 4
2

per man 1 tail:

 -f      The -f option causes tail to not stop when end of file is reached, but rather to wait for additional data to be appended to the input.  The -f option is ignored if the standard input is a pipe, but not if it is a FIFO.

 -F      The -F option implies the -f option, but tail will also check to see if the file being followed has been renamed or rotated.  The file is closed and reopened when tail detects that the filename being read from has a new inode number.  The -F option is
         ignored if reading from standard input rather than a file.

in another words, using tail -F logfile.log instead tail -f logfile.log should NOT get to file truncated message...

alexus
  • 13,112
  • 32
  • 117
  • 174
0

FWIW, I've had this happen even when I was properly using >> (or some other appending method, e.g. tee -a). In those cases the issue has turned out to be that a different process was writing to the same file, without appending.

In that situation, it might be that you can spot the process easily with ps, but if not, this answer has some discussion of methods to investigate what processes are accessing a file.

David Moles
  • 444
  • 1
  • 4
  • 13