14

I try to show tail of a text file. If file is small, there is no difference. However if file is too big (~5 gB), tailf does not respond. On the other hand tail -f works fine. What is difference between them?

umut
  • 1,016
  • 1
  • 12
  • 25
  • Read the `tailf` man page, it explains the different from `tail -f`. It sounds like your `tailf` program is not 64-bit. – Barmar Mar 31 '15 at 07:55
  • tailf is deprecated. It may have unfixed bugs and will be removed in March 2017. for latest versions, tail -f can be used for alternative of tailf. refer here for more details: https://manpages.ubuntu.com/manpages/xenial/man1/tailf.1.html – Abdullah Farweez Jan 05 '23 at 13:05

2 Answers2

15

I have faced the same issue. The log file was about 47GB. The tailf just waits almost infinite. But the tail -f begin to print the output within seconds.

I have digged deeper by examining the underlying system calls using strace command. The results given below:

# strace tailf /var/log/messages

(truncated)
stat("/var/log/messages", {st_mode=S_IFREG|0600, st_size=47432599401, ...}) = 0
open("/var/log/messages", O_RDONLY)     = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=47432600425, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7dba2d1000
read(3, "Nov  1 03:23:01 hostnameXXXX"..., 4096) = 4096
read(3, "0.31.148.12)\nNov  1 03:54:33 del"..., 4096) = 4096
read(3, "io.c(600) [receiver=3.0.6]\nNov  "..., 4096) = 4096
(truncated)

As you can see, the tailf is trying to read (buffer) all the lines from beginning before generating output to the screen.

Check the output of tail -f below, here it is using the system call lseek (C/C++) to directly jump to end of file and start reading from there:

# strace tail -f /var/log/messages

(truncated)
open("/var/log/messages", O_RDONLY)     = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=47294167448, ...}) = 0
lseek(3, 0, SEEK_CUR)                   = 0
lseek(3, 0, SEEK_END)                   = 47294170917
lseek(3, 47294169088, SEEK_SET)         = 47294169088
(truncated)
Seff
  • 1,546
  • 1
  • 17
  • 19
3

From the man page:

   tailf  will print out the last 10 lines of a file and then wait for the
   file to grow.  It is similar to tail -f but does not  access  the  file
   when  it  is not growing.  This has the side effect of not updating the
   access time for the file, so a filesystem flush does not occur periodi-
   cally when no log activity is happening.

http://linuxcommand.org/man_pages/tailf1.html

If it doesn't access the file directly it will have some difficulties with very lage files, depending on your machines setup.

Luke Girvin
  • 13,221
  • 9
  • 64
  • 84
Maximilian Kindshofer
  • 2,753
  • 3
  • 22
  • 37