How do continuously monitor a file that is being continuously overwritten? Specifically, the file contains a single line of text which a background process is repeatedly opening and re-writing.

I was hoping tail -F would work, but it doesn't.

Update: I was hoping this wouldn't be pertinent, but I'm running Mac OS X 10.5.8.

  • I wonder if screen could be coerced into doing this with some help from a script of some sort. – Paul Feb 25 '10 at 17:54

You can use watch to repeat a command execution, so in your case

watch -n 1 cat filename
  • This won't work on FreeBSD (or anywhere watch isn't what you expect it to be), also if the file rotates faster than every -n seconds you'll miss stuff... – voretaq7 Feb 25 '10 at 17:03
  • And watch doesn't seem to be on Mac OS X. (Not 10.5.8 at least.) – Daryl Spitzer Feb 25 '10 at 17:44
  • It works great on Linux though. – Daryl Spitzer Feb 25 '10 at 17:48
  • I would distrust any solution that involves fixed timing intervals (watch -n, anything with sleep, the linux tail with -s > 0). That's also leaving aside my objection to any solution that "only works on [insert platform]" – voretaq7 Feb 25 '10 at 18:49

There are better ways to do this, but it'll work

  while true ; do echo -n "`date +%s:` " >> file.log ; cat file >> file.log  ; done 

The file.log file will grow...rapidly...

If you need more features, like to check to see if the contents of the file are equal to the previous contents, you can expand this out into a script. Just comment below and I'll help.


On BSD systems (and I believe most other systems) tail -f will reset to the beginning of the file if it sees that the file has been truncated (this sounds like exactly the behavior you want).

On Linux systems the same thing happens, but at least on the Debian box I have laying around tail has a "polling interval", so you need to tell it not to sleep between checks of the file (tail -s 0 -f ...) for it to notice the truncation, otherwise strange things happen (if the file is the same size or smaller when it's written out you get no output, if it's bigger you get everything after tail's current byte-count marker, etc. -- Play with your tail impementation to see how it behaves)

As an alternative on both Linux and BSD systems tail has a -F option (which is like -f but checks to see if the file has been rotated -- i.e. the name points to a different inode number). This won't help you if the file is being truncated as opposed to unlink'd and replaced though.

  • tail on Mac OS X (10.5.8) doesn't have a -s option. – Daryl Spitzer Feb 25 '10 at 17:45
  • Mac OS X tail seems to have BSD-style semantics (-f handles truncation fine, -F handles deleted/recreated files) – voretaq7 Feb 25 '10 at 18:42
  • Also not obvious from my answer or comments but -F incorporates the same truncation semantics as -f. it just follows the name instead of the inode – voretaq7 Feb 25 '10 at 18:51

Poor man's watch:

while true
    cat file
    sleep 1

Change the cat if the file is longer than a screenful to something like:

tail -n $((LINES - 4)) file

You could add conditionals to check for a change in the file's timestamp, etc.


You could use the FSEvents API and a small script to monitor the file (or more precisely the directory which contains the file).

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.