"Tailing" grep (Was: cat and grep without destroying file)

[Gilles Gravier]

Joel Goguen wrote:
> On Sun, 2007-09-30 at 17:04 -0500, Brian Fahrlander wrote:
>   
>> While we've got the attention of the most-able on this subject, I'd 
>> like to reopen a discussion about a very similar tool: a 'grep' that 
>> happens on tailing a file.  There have been dozens of times that I'm 
>> looking for a message number in /var/log/mail.log and would love to see 
>> only the lines mentioning that message.
>>
>>      A couple of years ago I asked and got a "maybe you could write 
>> something", but I actually never could.  It's not as easy as it looks.
>>
>>      Any chance you guys have seen this done
> I have a great deal of success with 'tail -f /var/log/mail.log | grep
> XX' where XX is whatever you're looking for.  I actually use that exact
> set of commands on a daily basis when I'm at work.
>   

The magical part here is the "-f"... unfortunately, sometimes it's not 
magical enough. Indeed your mail.log is most likely a rolling log (i.e. 
when it reaches a certain size, the current mail.log is renamed to *.0, 
while the last *.0 is renamed *.1, the last *.1 is renamed *.2 and so on 
for the number of instances to be kept - for the /var/log/maillog it's 
6, if I remember well).

So the problem is when your file gets renamed *.0 that the "tail -f" 
will stop because tail refers the file by the inode which doesn't change 
when it is renamed... and when the renaming occurs, tail -f keeps 
watching the old file (now called *.0 and not being appendend anymore).

What you want is for "tail -f" to keep looking, every now and then, say 
every 5 seconds, to see if the file it was watching hasn't been moved 
and a new file with the same name is being populated instead...

There is a flag for "tail" to do just that.

Try "tail -F" (UPPERCASE "F" instead of lowercase "f")... :)

Have fun with your newly discovered "tail -F /var/log/mail.log".

Gilles.

-- 
/*Gilles Gravier*/ *=* *Gilles at Gravier.org* <mailto:Gilles at Gravier.org> 
*=* *http://www.gravier.org/*
ICQ : *77488526* 
<http://www.icq.com/whitepages/about_me.php?Uin=77488526> * || *MSN 
Messenger : Gilles at Gravier.org <http://members.msn.com/Gilles@Gravier.org>*
*Skype : ggravier <callto://ggravier>* || *Y! : ggravier 
<http://profiles.yahoo.com/ggravier> || AOL : gillesgravier 
<aim:goim?screenname=gillesgravier>
PGP Key ID : *0x8DE6D026* 
<http://pgp.mit.edu:11371/pks/lookup?search=0x8DE6D026&op=index>
My Last Known Position / Ma Derniere Position Connue 
<http://www.gmap-track.com/user.php?user=ggravier>
"Chastity is its own punishment." (/Solomon Short/) [/David Gerrold/]
"De toutes les aberrations sexuelles, la chasteté est la plus 
aberrante." [Anatole France]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/ubuntu-users/attachments/20071001/bda253c8/attachment.html>