Tailing a logfile with a changing filename
 

Hey All,

We continuously tail -f a particular log file while grepping for a certain pattern (and writing the output to another server for real-time analysis). For example:

This happens on a few different servers with different log files and so far there have been no problems.

We want to start monitoring a new log file, but the challenge is that the filename contains the date and is rotated/compressed nightly. (I'm unclear right now about exactly what process rotates it; it's not logrotate; it may be the service that writes the file). We could have a cron job to restart the tail each night with the new filename.

Another option would be to create a symlink to the logfile (which we tail) and have a job that continusouly ensures the link isn't broken. If it is, recreate it to point to the 'active' log file.

Neither of these solutions are very elegant, though, so I'm wondering if anyone had any ideas on a better way to do this.

I don't think the second way will work since changing the symlink won't affect an open filehandle. You will have to close and reopen.

Do you have access to the service's src; could you get it to restart the logtail (or alert it somehow) immediately after it rotates the log?

Thanks, Guys, for the replies.

chrism01, we do have access to the services source -- it's a cumbersome system so I'm not exactly sure what's rotating the logs, but we can probably track it down. Looks like that's probably the best approach.