I try to show tail of a text file. If file is small, there is no difference. However if file is too big (~5 gB), tailf does not respond. On the other hand tail -f works fine. What is difference between them?
Asked
Active
Viewed 1.2k times
14
-
Read the `tailf` man page, it explains the different from `tail -f`. It sounds like your `tailf` program is not 64-bit. – Barmar Mar 31 '15 at 07:55
-
tailf is deprecated. It may have unfixed bugs and will be removed in March 2017. for latest versions, tail -f can be used for alternative of tailf. refer here for more details: https://manpages.ubuntu.com/manpages/xenial/man1/tailf.1.html – Abdullah Farweez Jan 05 '23 at 13:05
2 Answers
15
I have faced the same issue. The log file was about 47GB. The tailf
just waits almost infinite. But the tail -f
begin to print the output within seconds.
I have digged deeper by examining the underlying system calls using strace
command. The results given below:
# strace tailf /var/log/messages
(truncated)
stat("/var/log/messages", {st_mode=S_IFREG|0600, st_size=47432599401, ...}) = 0
open("/var/log/messages", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=47432600425, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7dba2d1000
read(3, "Nov 1 03:23:01 hostnameXXXX"..., 4096) = 4096
read(3, "0.31.148.12)\nNov 1 03:54:33 del"..., 4096) = 4096
read(3, "io.c(600) [receiver=3.0.6]\nNov "..., 4096) = 4096
(truncated)
As you can see, the tailf
is trying to read (buffer) all the lines from beginning before generating output to the screen.
Check the output of tail -f
below, here it is using the system call lseek
(C/C++) to directly jump to end of file and start reading from there:
# strace tail -f /var/log/messages
(truncated)
open("/var/log/messages", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=47294167448, ...}) = 0
lseek(3, 0, SEEK_CUR) = 0
lseek(3, 0, SEEK_END) = 47294170917
lseek(3, 47294169088, SEEK_SET) = 47294169088
(truncated)

Seff
- 1,546
- 1
- 17
- 19
3
From the man page:
tailf will print out the last 10 lines of a file and then wait for the
file to grow. It is similar to tail -f but does not access the file
when it is not growing. This has the side effect of not updating the
access time for the file, so a filesystem flush does not occur periodi-
cally when no log activity is happening.
http://linuxcommand.org/man_pages/tailf1.html
If it doesn't access the file directly it will have some difficulties with very lage files, depending on your machines setup.

Luke Girvin
- 13,221
- 9
- 64
- 84

Maximilian Kindshofer
- 2,753
- 3
- 22
- 37