9

How do continuously monitor a file that is being continuously overwritten? Specifically, the file contains a single line of text which a background process is repeatedly opening and re-writing.

I was hoping tail -F would work, but it doesn't.

Update: I was hoping this wouldn't be pertinent, but I'm running Mac OS X 10.5.8.

3

5 Answers 5

7

You can use watch to repeat a command execution, so in your case

watch -n 1 cat filename
6
  • This won't work on FreeBSD (or anywhere watch isn't what you expect it to be), also if the file rotates faster than every -n seconds you'll miss stuff...
    – voretaq7
    Feb 25, 2010 at 17:03
  • And watch doesn't seem to be on Mac OS X. (Not 10.5.8 at least.) Feb 25, 2010 at 17:44
  • 1
    It works great on Linux though. Feb 25, 2010 at 17:48
  • 1
    I would distrust any solution that involves fixed timing intervals (watch -n, anything with sleep, the linux tail with -s > 0). That's also leaving aside my objection to any solution that "only works on [insert platform]"
    – voretaq7
    Feb 25, 2010 at 18:49
  • Besides this should be a little more CPU-intensive than tail, which should use inotify.
    – user202729
    Oct 19, 2021 at 15:44
1

There are better ways to do this, but it'll work

  while true ; do echo -n "`date +%s:` " >> file.log ; cat file >> file.log  ; done 

The file.log file will grow...rapidly...

If you need more features, like to check to see if the contents of the file are equal to the previous contents, you can expand this out into a script. Just comment below and I'll help.

1

On BSD systems (and I believe most other systems) tail -f will reset to the beginning of the file if it sees that the file has been truncated (this sounds like exactly the behavior you want).

On Linux systems the same thing happens, but at least on the Debian box I have laying around tail has a "polling interval", so you need to tell it not to sleep between checks of the file (tail -s 0 -f ...) for it to notice the truncation, otherwise strange things happen (if the file is the same size or smaller when it's written out you get no output, if it's bigger you get everything after tail's current byte-count marker, etc. -- Play with your tail impementation to see how it behaves)


As an alternative on both Linux and BSD systems tail has a -F option (which is like -f but checks to see if the file has been rotated -- i.e. the name points to a different inode number). This won't help you if the file is being truncated as opposed to unlink'd and replaced though.

3
  • tail on Mac OS X (10.5.8) doesn't have a -s option. Feb 25, 2010 at 17:45
  • Mac OS X tail seems to have BSD-style semantics (-f handles truncation fine, -F handles deleted/recreated files)
    – voretaq7
    Feb 25, 2010 at 18:42
  • Also not obvious from my answer or comments but -F incorporates the same truncation semantics as -f. it just follows the name instead of the inode
    – voretaq7
    Feb 25, 2010 at 18:51
1

Poor man's watch:

while true
do
    clear
    cat file
    sleep 1
done

Change the cat if the file is longer than a screenful to something like:

tail -n $((LINES - 4)) file

You could add conditionals to check for a change in the file's timestamp, etc.

0

You could use the FSEvents API and a small script to monitor the file (or more precisely the directory which contains the file).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .