Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We're using tail to continuously monitor several logs, but when a log is rotated the tail for that file will cease.

As far as I understand, the problem is that when the log is rotated, there is a new file created, and the running tail process doesn't know anything about that new file handle.

share|improve this question

8 Answers 8

I use command on my production server:

dev / # tail --follow var/log/apache-access_log --retry

share|improve this answer

As well as the above suggestions, it may be worth seeing if log4j supports a "copy & truncate" mode. This is something I know logrotate supports and is also useful for daemons which don't like having their log file ripped out from under them.

Instead of moving the log file, it copies to a new file and truncates the old one. It's not ideal, since there's a small window of time while the copy is taking place where you may lose logs, but sometimes it's necessary.

share|improve this answer

IMHO, it's a little odd to change your log file by SIZE rather than by date. Most system logs (in unix or linux) rotate on a weekly or monthly basis, and not based on size...This is something I like for various reasons, and also something which, if implemented, would solve your problem.

share|improve this answer
    
I agree and this is one thing I realized I should look into. Hopefully log4j supports it. Thanks! –  DivideByHero Nov 10 '09 at 20:53
    
One clear advantage of rotation by size is you can be sure the entire set of logs will be less than some known size. –  Jim Zajkowski Nov 11 '09 at 15:28
# tail --follow=mylog.log

From man tail:

With --follow (-f), tail defaults to  following  the  file  descriptor,
       which  means that even if a tail’ed file is renamed, tail will continue
       to track its end.  This default behavior  is  not  desirable  when  you
       really want to track the actual name of the file, not the file descrip‐
       tor (e.g., log rotation).  Use --follow=name in that case.  That causes
       tail  to track the named file by reopening it periodically to see if it
       has been removed and recreated by some other program.

So in this case using the -F option would be correct.

-F     same as --follow=name --retry
share|improve this answer
    
Ah ha! It works! Thanks so much! –  DivideByHero Nov 10 '09 at 22:06

The exact answer depends on your OS - but in many cases, tail -F will do the right thing.

share|improve this answer
1  
If tail -F doesn't work, compile a version of tail -F that does. The other alternative is a short road to crazy town. –  chris Nov 10 '09 at 20:23

Also, it might be a little too heavy-duty for your purposes, but splunk has a tail feature to do exactly what you want. It's free for up to 500 MB/day, but if your data is beyond that in size it wouldn't be worth the cost.

share|improve this answer
up vote 20 down vote accepted

Ah, there's a flag for this.

instead of using tail -f /var/log/file we should be using tail -F /var/log/file


tail -F translates to tail --follow=name --retry as in;

  • --follow=name: follow the name of the file instead of the file descriptor
  • --retry: if the file is inaccessible, try again later instead of dying
share|improve this answer

tail -F or tail --follow=name

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.