Alternative for "tail -f" that follows filename

Question

I have some logs being generated using a timed rotating file logger. This logs to a file called tool.log, and at midnight, moves this to tool.log.<date> and starts a new tool.log.

I have a tail -f tool.log running on the machine to keep an eye on the logs, but at midnight, when tool.log is renamed to tool.log.<date>, tail continues to watch the renamed file.

What I'm hoping for is a tool that is similar to tail, but will continue to monitor the file named tool.log, rather than following the inode.

Does something like this exist? If not, I can write my own in Python for this purpose.

Related: https://unix.stackexchange.com/questions/22698/how-to-do-a-tail-f-of-log-rotated-files — Ciro Santilli OurBigBook.com, Aug 10 '23 at 09:21

score 94 · Accepted Answer · edited Jun 12 '20 at 13:48

Some implementations of tail have an option for this; here's the description from the man page for GNU tail:

-F
same as --follow=name --retry

-f, --follow[={name|descriptor}]
output appended data as the file grows; -f, --follow, and --follow=descriptor are equivalent

--retry
keep trying to open a file even when it is or becomes inaccessible; useful when following by name, i.e., with --follow=name

As this option isn't specified by POSIX, you can't depend on it everywhere. Some known implementations:

GNU - has -F as described above
Mac OS X, FreeBSD and NetBSD - have a similar -F option with the same effect
OpenBSD - -f is enough (if the file is replaced (i.e., the inode number changes), tail will reopen the file and continue)
Solaris - no equivalent
Busybox - -F is available in recent versions, but must be compiled with ENABLE_FEATURE_FANCY_TAIL (it's not compiled-in by default)

score 55 · Answer 2 · edited Apr 05 '16 at 16:27

55

Alternative is tail -F command.

The -F option implies --follow=name with --retry option, so tail is watching your file even if it has been deleted and created again.

edited Apr 05 '16 at 16:27

Toby Speight

4,866
1
26
36

answered Mar 29 '16 at 12:54

Oleg Bolden

1,687
14
14

score 5 · Answer 3 · answered May 11 '16 at 18:29

5

^{Since you have asked for alternative:}

The less utility could be an alternative for tail -F.

It will have to be run as follows: less --follow-name filename.log and press Shift + F.

This will give you same results as tail -F.

answered May 11 '16 at 18:29

VL-80

4,475
2
28
38

Thanks. I was only after an alternative because I was unaware of tail -F. Always good to know options though. – Hugh May 15 '16 at 02:39
I see two problematic things with `less +F --follow-name`: **1.** it fails if the file does not exist at the time `less` is started. **2.** `less` frequently crashes when the content of the file is replaced. – pabouk - Ukraine stay strong Jul 12 '23 at 08:31

score 4 · Answer 4 · answered Mar 31 '16 at 14:54

4

Another alternative would be to use the watch command, which will repeat any command every n seconds, every 2 seconds in this example:

watch -n2 "tail tool.log"

Use Ctrl+C to quit the command when you're finished viewing the log.

answered Mar 31 '16 at 14:54

Arronical

140
4

1

This seems like it would create a lot of duplicate messages if the log scrolled slower than the refresh timer, and would miss some messages if it scrolled faster. – Bobson Mar 31 '16 at 17:51
4

Watch takes over the whole screen, so it wouldn't duplicate messages, but it would remove the ability to scroll back. – Hugh Mar 31 '16 at 20:15

score 3 · Answer 5 · answered Mar 31 '16 at 20:13

3

lnav is another fantastic tool that follows the filename.

You can also point it to a directory and it will tail all the files in that directory, in addition to all kinds of other neat features.

answered Mar 31 '16 at 20:13

Wayne Werner

2,193
2
20
29

I've found it doesn't handle truncated and/or renamed rotated logs (I'm not sure which is upsetting it in my particular case) so the logs appear to stop at midnight unless I restart lnav. Am I missing some obvious switch or technique for it I wonder as this seems like something it should take in its stride? – Stuart Hickinbottom Jan 20 '17 at 07:57
It depends on how the file is truncated. If you pass the `-r` flag to lnav it will reload the filename (and load any previously rotated out logs) – Wayne Werner Jan 20 '17 at 16:12

score 1 · Answer 6 · answered Mar 31 '16 at 15:01

1

I'm not sure if multitail will handle your specific case, but I bet it does. multitail does pretty much everything you could want tail to do.

https://en.wikipedia.org/wiki/MultiTail

answered Mar 31 '16 at 15:01

Andy Lester

1,253
6
15

1

Yes it will -- `multitail -f -f -f ...`. This example shows following several files simultaneously, which will be shown in separate windows. – Stuart Hickinbottom Jan 20 '17 at 07:56

Alternative for "tail -f" that follows filename

6 Answers6

Linked