LinuxQuestions.org - Cannot use tail -f to monitor log file

- Ubuntu (https://www.linuxquestions.org/questions/ubuntu-63/)

- - Cannot use tail -f to monitor log file (https://www.linuxquestions.org/questions/ubuntu-63/cannot-use-tail-f-to-monitor-log-file-774690/)

Cannot use tail -f to monitor log file

I use tail -f on /var/log/messages to check the latest update on the log file. It show last 10 line of the file and
command continue to run but didn't show the update of the log file (real time).
As I know , the command should show latest entry to the log file time to time

I use this "tail -f /var/log/messages"

pls anyone guide me what did i do wrong.

I am not sure you are doing anything wrong....have you checked that there were changes?

I had to use /log/auth.log and open and close a root terminal to prove it works ok for me
tail -f /var/log/auth.log

Quote:

Originally Posted by aus9 (Post 3786446)

I tried with tail -f /var/log/auth.log it is working but i cannot monitor like this to every file

Can you tell me why ?

I create a file with touch "touch test "and tried to change the file during the monitoring period (tail -f touch )but tail -f shows nothing .

Please explain me

thank you for your help

tail -f is not showing anything because the file is empty and not changing

Code:

c:/tmp$ touch foo

c:/tmp$ tail -f foo

[nothing displayed until did echo wibble > /tmp/foo in another terminal when got ...]

wibble

Quote:

Originally Posted by catkin (Post 3787426)

tail -f is not showing anything because the file is empty and not changing

Code:

c:/tmp$ touch foo

c:/tmp$ tail -f foo

[nothing displayed until did echo wibble > /tmp/foo in another terminal when got ...]

wibble

Sorry I forgot to mention that After "touch"
I "vim touch test" and add some line but

In the mean time I run tail -f from the beginning but shows nothing .

You created a new file which tail is not monitoring. Instead open two terminals in the same directory. run:
touch testfile
tail -f testfile

Now in the second terminal, run "ls >>testfile.

When a program opens a file, it gets a file descriptor back, which is an integer. This file descriptor is used for further reads and writes.

When you saved the file you loaded in vim, you created a new file with a new inode. The tail command still has the original file open. It won't be closed until you quit "tail -f" by pressing CTRL-C. After doing that, the kernel will delete the file.

Code:

touch testfile2

jschiwal@netcow:~/Download> ls -li testfile2

5963813 -rw-r--r-- 1 jschiwal jschiwal 0 2009-12-11 01:05 testfile2

jschiwal@netcow:~/Download> tail -f testfile2



vim testfile2

jschiwal@netcow:~/Download> ls -li testfile2

5963815 -rw-r--r-- 1 jschiwal jschiwal 28 2009-12-11 01:05 testfile2



ps -C tail

  PID TTY          TIME CMD

19111 pts/3    00:00:00 tail

jschiwal@netcow:~/Download> ls -l /proc/19111/fd/

total 0

lrwx------ 1 jschiwal jschiwal 64 2009-12-11 01:08 0 -> /dev/pts/3

lrwx------ 1 jschiwal jschiwal 64 2009-12-11 01:08 1 -> /dev/pts/3

lrwx------ 1 jschiwal jschiwal 64 2009-12-11 01:07 2 -> /dev/pts/3

lr-x------ 1 jschiwal jschiwal 64 2009-12-11 01:08 3 -> /home/jschiwal/Download/testfile2~ (deleted)



jschiwal@netcow:~/Download> lsof +L1

COMMAND    PID    USER  FD  TYPE DEVICE SIZE/OFF NLINK    NODE NAME

amarok    13605 jschiwal  15u  REG    8,6        0    0  770202 /tmp/ibAniGv6 (deleted)

amarok    13605 jschiwal  16u  REG    8,6        0    0  770205 /tmp/ibHBfmQS (deleted)

amarok    13605 jschiwal  17u  REG    8,6        0    0  770210 /tmp/iboYw2aF (deleted)

amarok    13605 jschiwal  18u  REG    8,6        0    0  770211 /tmp/ibEJsPxr (deleted)

amarok    13605 jschiwal  22u  REG    8,6        0    0  770212 /tmp/ib8sR5ce (deleted)

kio_file  18035 jschiwal  txt    REG    8,6    48648    0 1803959 /usr/bin/kdeinit4 (deleted)

tail      19111 jschiwal    3r  REG    8,7        0    0 5963813 /home/jschiwal/Download/testfile2~ (deleted)



...

As you can see, it is common for programs to create temporary files, delete them, but continue to use the file descriptors to write to them. If the program crashes, the temporary file will be removed by the kernel automatically. It also solves the problem if the psuedo random filename of another program's temporary file happens to have the same name. It doesn't matter, the program won't be blocked from creating a new file.

Quote:

Originally Posted by v0nd00 (Post 3787439)

Sorry I forgot to mention that After "touch"
I "vim touch test" and add some line but

In the mean time I run tail -f from the beginning but shows nothing .

Works for me but only after writing the file from within vim (and gives error on making file shorter)

Code:

c:/tmp$ rm foo

c:/tmp$ touch foo

c:/tmp$ tail -f foo

[In vi (vim): ii:w]

i

[In vi (vim): d:w]

tail: foo: file truncated

Quote:

Originally Posted by v0nd00 (Post 3787439)

Sorry I forgot to mention that After "touch"
I "vim touch test" and add some line but

In the mean time I run tail -f from the beginning but shows nothing .

I got it now , it is working

thank you