Friday, November 22

One thing about "tail -f"

Don't trust "tail -f".

"tail -f" means to follow a file and always show the new information of that file. For example, open one terminal and "tail -f /var/log/mysql/error.log", then this terminal should show whatever new messages being written to error.log.


Until midnight when the crontab kicks in to do log rotation. The log rotation program zips the error.log into error.log.1.gz and removes error.log. The mysql will write new log information into a new error.log, but the terminal which has "tail -f /var/log/mysql/error.log" is not able to follow the new error.log any more. You are missing information in this terminal.

So if you have reason to believe "tail -f" output is not correct, you should check the file to see whether it is actually modified (re-created).

I was thinking it shouldn't be difficult to modify source code for the purpose of following a file even if it is being re-created, then I checked the code, and found the functionality is already implemented! Hoolay to open source! You can either use
  tail --follow-name --retry error.log
or in short, use capital F:
  tail -F error.log
to follow the file.

Happy Hacking!