<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> <title></title> </head> <body bgcolor="#ffffff" text="#000000"> Joel Goguen wrote: <blockquote cite="mid:1191191607.26806.5.camel@hermes" type="cite"> <pre wrap="">On Sun, 2007-09-30 at 17:04 -0500, Brian Fahrlander wrote: </pre> <blockquote type="cite"> <pre wrap="">While we've got the attention of the most-able on this subject, I'd like to reopen a discussion about a very similar tool: a 'grep' that happens on tailing a file. There have been dozens of times that I'm looking for a message number in /var/log/mail.log and would love to see only the lines mentioning that message. A couple of years ago I asked and got a "maybe you could write something", but I actually never could. It's not as easy as it looks. Any chance you guys have seen this done</pre> </blockquote> <pre wrap="">I have a great deal of success with 'tail -f /var/log/mail.log | grep XX' where XX is whatever you're looking for. I actually use that exact set of commands on a daily basis when I'm at work. </pre> </blockquote> The magical part here is the "-f"... unfortunately, sometimes it's not magical enough. Indeed your mail.log is most likely a rolling log (i.e. when it reaches a certain size, the current mail.log is renamed to *.0, while the last *.0 is renamed *.1, the last *.1 is renamed *.2 and so on for the number of instances to be kept - for the /var/log/maillog it's 6, if I remember well). So the problem is when your file gets renamed *.0 that the "tail -f" will stop because tail refers the file by the inode which doesn't change when it is renamed... and when the renaming occurs, tail -f keeps watching the old file (now called *.0 and not being appendend anymore). What you want is for "tail -f" to keep looking, every now and then, say every 5 seconds, to see if the file it was watching hasn't been moved and a new file with the same name is being populated instead... There is a flag for "tail" to do just that. Try "tail -F" (UPPERCASE "F" instead of lowercase "f")... :) Have fun with your newly discovered "tail -F /var/log/mail.log". Gilles. <div class="moz-signature">-- <meta content="text/html; " http-equiv="content-type"> <title>Signature Home Chastity</title> <meta content="Gilles Gravier" name="author"> <div style="text-align: left;"> <table style="text-align: left; background-color: rgb(102, 102, 102); width: 500px; height: 73px;" border="1" cellpadding="3" cellspacing="3"> <tbody> <tr> <td style="text-align: center; vertical-align: middle; background-color: rgb(204, 204, 204); white-space: nowrap;"> <div style="text-align: center; background-color: rgb(204, 204, 204);"><tt>Gilles Gravier = <a href="mailto:Gilles@Gravier.org">Gilles@Gravier.org</a> = <a href="http://www.gravier.org/">http://www.gravier.org/</a></tt> </div> <div style="text-align: center; background-color: rgb(204, 204, 204);"><tt>ICQ : <a href="http://www.icq.com/whitepages/about_me.php?Uin=77488526">77488526</a></tt> <tt> || </tt><tt>MSN Messenger : <a href="http://members.msn.com/Gilles@Gravier.org">Gilles@Gravier.org</a></tt><tt> </tt>Skype<tt> : <a href="callto://ggravier">ggravier</a></tt><tt> || </tt><tt>Y! : <a href="http://profiles.yahoo.com/ggravier">ggravier</a></tt><tt style="font-weight: bold;"> || </tt><tt>AOL : <a href="aim:goim?screenname=gillesgravier">gillesgravier</a> </tt><tt>PGP Key ID : <a href="http://pgp.mit.edu:11371/pks/lookup?search=0x8DE6D026&op=index">0x8DE6D026</a></tt> </div> <div style="text-align: center; background-color: rgb(204, 204, 204);"><tt><a style="font-weight: bold; color: rgb(0, 153, 0);" href="http://www.gmap-track.com/user.php?user=ggravier">My Last Known Position / Ma Derniere Position Connue</a> "Chastity is its own punishment." (Solomon Short) [David Gerrold] </tt>"De toutes les aberrations sexuelles, la chasteté est la plus aberrante." [Anatole France] </div> </td> </tr> </tbody> </table> </div> </div> </body> </html>