4

I was watching a log file (logfile.log) with tail -f, and after a few minutes, the following message was written to the file:

tail: logfile.log: file truncated

I've never seen that before and I'm wonder why it happened, and how I can prevent it. The file is being written to by root (via a cronjob), and was created by another user.

It also seems that the cronjob is actually overwriting the logfile each time. I guess that this is probably the reason for the message I was seeing.

Edit Here's what the cronjob looks like:

* * * * * /usr/local/bin/ruby /home/web/script.rb > >/home/web/logfile.log 2>&1
  • 2
    It's around midnight on the east coast. Do you have any log rotation jobs running? – jgoldschrafe Oct 5 '12 at 4:56
  • Could be, but this logfile wouldn't be part of that (unless somehow the log rotation jobs are picking up every *.log file on the system?) Besides, our servers are in PST. – bricker Oct 5 '12 at 5:00
  • 1
    I dont know if its just a typo.. but shouldnt it be ..../script.rb >>/home/web/logfile.log for it to propertly append? Your code seems to have a space between the double angle bracket – Karthik T Oct 5 '12 at 5:16
  • 1
    For the benefit of anyone else reading this question in the future who is seeing that error, but you know that the log file is being rotated/purged, you can avoid the error above using tail -F instead of tail -f – Bryan Oct 5 '12 at 7:22
7

I dont know if its just a typo.. but shouldnt it be ..../script.rb >> /home/web/logfile.log for it to propertly append? Your code seems to have a space between the double angle bracket

I tried it just now on bash in mac, it prompted an error, perhaps some shells may just ignore the second angle arrow in this case

0

FWIW, I've had this happen even when I was properly using >> (or some other appending method, e.g. tee -a). In those cases the issue has turned out to be that a different process was writing to the same file, without appending.

In that situation, it might be that you can spot the process easily with ps, but if not, this answer has some discussion of methods to investigate what processes are accessing a file.

0

per man 1 tail:

 -f      The -f option causes tail to not stop when end of file is reached, but rather to wait for additional data to be appended to the input.  The -f option is ignored if the standard input is a pipe, but not if it is a FIFO.

 -F      The -F option implies the -f option, but tail will also check to see if the file being followed has been renamed or rotated.  The file is closed and reopened when tail detects that the filename being read from has a new inode number.  The -F option is
         ignored if reading from standard input rather than a file.

in another words, using tail -F logfile.log instead tail -f logfile.log should NOT get to file truncated message...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.