How can I use tail utility to view a log file that is frequently recreated

Question

I need a solution in creating a script to tail a log file that is recreated (with the same name) after it reaches a certain size.

Using "tail -f" causes the tailing to stop when the file is recreated/rotated.

What I would like to do is create a script that would tail the file and after it reaches 100 lines for example, then restart the command... Or even better to restart the command when the file is recreated?

Is it possible?

evan · Answer 1 · 2017-06-07T20:12:15.890

23

Yes! Use this (the retry will make tail retry when the file doesn't exist or is otherwise inaccessible rather than just failing - such as potentially when you are changing files):

tail -f --retry <filename>

OR

tail --follow=name --retry

OR

tail -F <filename>

edited Jun 07 '17 at 20:12

answered Jul 26 '11 at 09:52

evan

12,307
7
37
51

~> tail -f --follow=name --retry /logs/logs/log.log tail: cannot open input – gfunk Jul 26 '11 at 13:36
It looks like you have `/logs` in there twice. Is that intentional? If that file doesn't exist or you don't have permissions, you will get an error. However, with `--retry` it will keep trying until the file exists or you have permissions to it. Try it out with a test file in the current directory first. – evan Jul 26 '11 at 18:45
yes that was intentional. This is the directory where my logs are stored. Unfortunately this version of tail doesn't support -F or --follow=name. I'm trying to find another way to do this with a script. – gfunk Jul 28 '11 at 14:27
2

OS X tail doesn't support the `--retry` option. – bonh May 10 '16 at 13:30
5

On macOS, you can install and use the GNU version of `tail` easily with [homebrew](https://brew.sh). Install with: `brew install coreutils`. Use with: `gtail -f --follow=name --retry ` (The gnu utils are prefixed with `g` in order not to conflict with the macOS core tools.) – fiedl May 27 '17 at 17:23

score 2 · Answer 2 · edited Dec 19 '13 at 06:35

If tail -F is not available, and you are trying to recover from logrotate, you may add the copytruncate option to your logrotate.d/ spec file so instead of creating a new file each time after rotation, the file is kept and truncated, while a copy is rotated out.

This way the old file handle continues to point to the new (truncated) log file where new logs are appended.

Note that there may be some loss of data during this copy-truncate process.

score 2 · Answer 3 · edited Aug 05 '12 at 18:09

2

try running

watch "tail -f" yourfile.log

edited Aug 05 '12 at 18:09

eckes

64,417
29
168
201

answered Jul 26 '11 at 09:46

xuuso

571
5
14

watch is unavailable on the system i'm running unfortunately – gfunk Jul 26 '11 at 13:48

Lynch · Answer 4 · 2011-07-26T20:30:56.337

Since you dont have a tail that support all the features and because you dont have watch you could use a simple script that loop indefinitely to execute the tail.

#!/bin/bash 

PID=`mktemp`
while true;
do
  [ -e "$1" ] && IO=`stat -c %i "$1"`
  [ -e "$1" ] && echo "restarting tail" && { tail -f "$1" 2> /dev/null & echo $! > $PID; }

  # as long as the file exists and the inode number did not change
  while [[ -e "$1" ]] && [[ $IO = `stat -c %i "$1"` ]]
  do
     sleep 0.5
  done
  [ ! -z $PID ] && kill `cat $PID` 2> /dev/null && echo > $PID
  sleep 0.5
done 2> /dev/null
rm -rf $PID

You might want to use trap to cleanly exit this script. This is up to you.

Basicaly, this script check if the inode number (using stat -c %i "$1") change to kill the tail command and start a new one when the file is recreated.

Note: you might get rid of the echo "restarting tail" which will pollute your output. It was only useful for testing. Also problems might occur if the file is replaced after we check the inode number and before we start the tail process.

How can I use tail utility to view a log file that is frequently recreated

4 Answers4