Cannot use tail -f to monitor log file

v0nd00 · 12-10-2009, 04:13 AM

I use tail -f on /var/log/messages to check the latest update on the log file. It show last 10 line of the file and
command continue to run but didn't show the update of the log file (real time).
As I know , the command should show latest entry to the log file time to time

I use this "tail -f /var/log/messages"

pls anyone guide me what did i do wrong.

aus9 · 12-10-2009, 04:46 AM

I am not sure you are doing anything wrong....have you checked that there were changes?

I had to use /log/auth.log and open and close a root terminal to prove it works ok for me
tail -f /var/log/auth.log

v0nd00 · 12-11-2009, 12:07 AM

Quote:

Originally Posted by aus9

I am not sure you are doing anything wrong....have you checked that there were changes?

I had to use /log/auth.log and open and close a root terminal to prove it works ok for me
tail -f /var/log/auth.log

I tried with tail -f /var/log/auth.log it is working but i cannot monitor like this to every file

Can you tell me why ?

I create a file with touch "touch test "and tried to change the file during the monitoring period (tail -f touch )but tail -f shows nothing .

Please explain me

thank you for your help

catkin · 12-11-2009, 12:40 AM

tail -f is not showing anything because the file is empty and not changing

Code:

c:/tmp$ touch foo
c:/tmp$ tail -f foo
[nothing displayed until did echo wibble > /tmp/foo in another terminal when got ...]
wibble

v0nd00 · 12-11-2009, 12:52 AM

Quote:

Originally Posted by catkin

tail -f is not showing anything because the file is empty and not changing

Code:

c:/tmp$ touch foo
c:/tmp$ tail -f foo
[nothing displayed until did echo wibble > /tmp/foo in another terminal when got ...]
wibble

Sorry I forgot to mention that After "touch"
I "vim touch test" and add some line but

In the mean time I run tail -f from the beginning but shows nothing .

jschiwal · 12-11-2009, 01:18 AM

You created a new file which tail is not monitoring. Instead open two terminals in the same directory. run:
touch testfile
tail -f testfile

Now in the second terminal, run "ls >>testfile.

When a program opens a file, it gets a file descriptor back, which is an integer. This file descriptor is used for further reads and writes.

When you saved the file you loaded in vim, you created a new file with a new inode. The tail command still has the original file open. It won't be closed until you quit "tail -f" by pressing CTRL-C. After doing that, the kernel will delete the file.

Code:

touch testfile2
jschiwal@netcow:~/Download> ls -li testfile2
5963813 -rw-r--r-- 1 jschiwal jschiwal 0 2009-12-11 01:05 testfile2
jschiwal@netcow:~/Download> tail -f testfile2

vim testfile2
jschiwal@netcow:~/Download> ls -li testfile2
5963815 -rw-r--r-- 1 jschiwal jschiwal 28 2009-12-11 01:05 testfile2

ps -C tail
  PID TTY          TIME CMD
19111 pts/3    00:00:00 tail
jschiwal@netcow:~/Download> ls -l /proc/19111/fd/
total 0
lrwx------ 1 jschiwal jschiwal 64 2009-12-11 01:08 0 -> /dev/pts/3
lrwx------ 1 jschiwal jschiwal 64 2009-12-11 01:08 1 -> /dev/pts/3
lrwx------ 1 jschiwal jschiwal 64 2009-12-11 01:07 2 -> /dev/pts/3
lr-x------ 1 jschiwal jschiwal 64 2009-12-11 01:08 3 -> /home/jschiwal/Download/testfile2~ (deleted)

jschiwal@netcow:~/Download> lsof +L1
COMMAND     PID     USER   FD   TYPE DEVICE SIZE/OFF NLINK    NODE NAME
amarok    13605 jschiwal   15u   REG    8,6        0     0  770202 /tmp/ibAniGv6 (deleted)
amarok    13605 jschiwal   16u   REG    8,6        0     0  770205 /tmp/ibHBfmQS (deleted)
amarok    13605 jschiwal   17u   REG    8,6        0     0  770210 /tmp/iboYw2aF (deleted)
amarok    13605 jschiwal   18u   REG    8,6        0     0  770211 /tmp/ibEJsPxr (deleted)
amarok    13605 jschiwal   22u   REG    8,6        0     0  770212 /tmp/ib8sR5ce (deleted)
kio_file  18035 jschiwal  txt    REG    8,6    48648     0 1803959 /usr/bin/kdeinit4 (deleted)
tail      19111 jschiwal    3r   REG    8,7        0     0 5963813 /home/jschiwal/Download/testfile2~ (deleted)

...

As you can see, it is common for programs to create temporary files, delete them, but continue to use the file descriptors to write to them. If the program crashes, the temporary file will be removed by the kernel automatically. It also solves the problem if the psuedo random filename of another program's temporary file happens to have the same name. It doesn't matter, the program won't be blocked from creating a new file.

catkin · 12-11-2009, 01:26 AM

Quote:

Originally Posted by v0nd00

Sorry I forgot to mention that After "touch"
I "vim touch test" and add some line but

In the mean time I run tail -f from the beginning but shows nothing .

Works for me but only after writing the file from within vim (and gives error on making file shorter)

Code:

c:/tmp$ rm foo
c:/tmp$ touch foo
c:/tmp$ tail -f foo
[In vi (vim): ii:w]
i
[In vi (vim): d:w]
tail: foo: file truncated

v0nd00 · 12-11-2009, 02:05 AM

Quote:

Originally Posted by v0nd00

Sorry I forgot to mention that After "touch"
I "vim touch test" and add some line but

In the mean time I run tail -f from the beginning but shows nothing .

I got it now , it is working

thank you