Categories
DailyOps

How to follow data appended to a file using tail command

Follow data appended to a file using one of the two possible approaches.

Follow the file descriptor

This is the default behavior. The tail process will follow the file descriptor instead of the name.

$ tail /var/log/application.log |
                                | $ echo "[$(date +"%d.%m.%y %H:%M")] log entry" | tee -a /var/log/application.log 
[19.06.21 23:42] log entry      | 
                                | $ mv /var/log/application.log /var/log/application.log.1
                                | 
                                | $ echo "[$(date +"%d.%m.%y %H:%M")] log entry" | tee -a /var/log/application.log
                                |
                                | 

Nothing will be printed as the tail is command is following the /var/log/application.log.1 file.

The above example is equivalent to the following command.

$ tail --follow=descriptor /var/log/application.log

Follow the file name

This behavior will ensure that the tail process will follow the file name instead of the descriptor.

$ tail --follow=name --retry /var/log/application.log                               |
                                                                                    | $ echo "[$(date +"%d.%m.%y %H:%M")] log entry" | tee -a /var/log/application.log 
[19.06.21 23:44] log entry                                                          | 
                                                                                    | $ mv /var/log/application.log /var/log/application.log.1
tail: '/var/log/application.log' has become inaccessible: No such file or directory | 
                                                                                    | $ echo "[$(date +"%d.%m.%y %H:%M")] log entry" | tee -a /var/log/application.log
tail: '/var/log/application.log' has appeared;  following new file                  | 
[19.06.21 23:45] log entry                                                          |
                                                                                    |
                                                                                    |

The tail process is following the /var/log/application.log file, so it behaves as expected.

Inspect the manual page for more information.

[...]

       -f, --follow[={name|descriptor}]
              output appended data as the file grows;

              an absent option argument means 'descriptor'

       -F     same as --follow=name --retry

[...]

       --retry
              keep trying to open a file if it is inaccessible

[...]

       With  --follow (-f), tail defaults to following the file descriptor, which means that even if a tail'ed file is renamed, tail will continue to track its end.  This default behavior is not desirable when you really want to track the actual name of the file, not
       the file descriptor (e.g., log rotation).  Use --follow=name in that case.  That causes tail to track the named file in a way that accommodates renaming, removal and creation.

[...]

This is simple, but fascinating!