Wednesday, September 4, 2013

Handling file rollover with tail monitoring

The most of us probably already know the command:
tail -f <your_file_to_monitor>
it's useful for monitoring whatever has been appended to the file called <your_file_to_monitor>.

OK, nothing new here (probably). I could not live without it any more I guess, once I got used to it (as it offers me all the power of linux shell - like piping the output to other command, etc.).

The common use case for me is monitoring of the log files created by various java logging frameworks (log4j/sl4j/whatever is used).

Log file rollover problem

Maybe you've noticed that this works, but from time to time, no more messages are printed. Why that happens? You need to restart it to have it running again.

The common problem is the usage of file rollover (for example if file exceeds particular size to be backed up named by specified pattern and logging continues to the empty file named the same as the original one). This is a good practice to prevent log file unlimited growing and keeping some history across application restarts.

But the nice guys doing tail considered this option obviously. If you check the man page it has some switches that can be used for the case. Here are the relevant ones:
      keep trying to open a file even if it is inaccessible when  tail
      starts  or if it becomes inaccessible later; useful when follow-
      ing by name, i.e., with --follow=name

-f, --follow[={name|descriptor}]
      output appended data as the file grows; -f, --follow, and --fol-
      low=descriptor are equivalent

-F     same as --follow=name --retry
So to have things running even despite of log file rollover, you should go for:
tail -F <your_file_to_monitor>
That's it. Easy right?

No comments: