Stop using tail -f (mostly) • Hacker News Board

Re: Stop using tail -f (mostly)

#31

Post by bch » Mon, Mar 30, 2015, 4:55 PM UTC

evincarofautumn wrote: post #21

pimlottc wrote: post #15

I was introduced to less +F a while ago and it is quite nice, but there is one simple "feature" of tail -f that I miss quite a lot: being able 'mark' the log with gaps by hitting enter a few times. This is especially handy when you have to first load a page or warm up the app before performing the operation you're interested in watching, letting you separate the earlier output from the lines generated by what you're…

With less, you can use m to mark the current position and ' to go to a marked position. h will show you lots of useful help.

An example of some of the vi commands that less(1) has adopted. You can also:

  * page forward and backward, including using numeric prefixes to indicate a lineno or indicate "repeat 'n' times".
  * launch vi if less(1) is working on a file (versus (eg) stdout of some process)
  * search fwd/backward
  * start examining a new file w/o leaving less(1)
  * ...

Re: Stop using tail -f (mostly)

#32

Post by oimaz » Mon, Mar 30, 2015, 4:55 PM UTC

less +F is not such a good alternative to "tail -f" or better "tail -F" especially when you are filtering the output of tail using grep or awk.

Re: Stop using tail -f (mostly)

#33

Post by Filligree » Mon, Mar 30, 2015, 4:58 PM UTC

stonogo wrote: post #18

Be very, very careful with this: http://seclists.org/fulldisclosure/2014/Nov/74 But really, it's 2015. Are you really using a terminal emulator without a buffer search? Are you not using screen or tmux, both of which can do these things natively, with no external tools? Why? And what is wrong with backgrounding the tail command, running your grep, and then foregrounding the tail command?

Personally? The reason I'm not using screen is that there's no way to atomically [attach, create new window] in screen and I value my gnome-terminal tabs.

If tmux can do that, then I'd consider it reason to switch.

Re: Stop using tail -f (mostly)

#34

Post by jcfrei » Mon, Mar 30, 2015, 4:58 PM UTC

The biggest nag I have with tail is that it stops tracking a file once it gets moved and a new one is created in its place (through log rotation).

Re: Stop using tail -f (mostly)

#35

Post by emilsedgh » Mon, Mar 30, 2015, 4:59 PM UTC

For lazy people out there:

There is also the command `tailf` which is quite similar to 'tail -f'.

2 characters make so much difference :)

Re: Stop using tail -f (mostly)

#36

Post by noddingham » Mon, Mar 30, 2015, 5:00 PM UTC

fweespeech wrote: post #19

nothrabannosir wrote: post #9

Even when you don't want less +F, a good alternative to tail -f is tail -F. It survives log rotation, and the file being temporarily inaccessible: --retry keep trying to open a file even if it is inaccessible when tail starts or if it becomes inaccessible later; useful when follow- ing by name, i.e., with --follow=name -F same as --follow=name --retry

Yeah, tail -F is the way to go imo. Also, if you are using a proper ssh client, opening a second ssh connection to manage the reacting to the log files is habit for me at this point. The only time I'm using tail -F is after a new configuration deployment. Otherwise, I'm looking at archival data in ELK.

Have you tried using screen[1]? Might make things a little easier than have two separate SSH connections.

[1] https://www.gnu.org/software/screen/

Re: Stop using tail -f (mostly)

#37

Post by igorgue » Mon, Mar 30, 2015, 5:00 PM UTC

Wait... Isn't less gonna read the whole file at first? That might suck for files that are already huge.

Re: Stop using tail -f (mostly)

#38

Post by vially » Mon, Mar 30, 2015, 5:01 PM UTC

jcfrei wrote: post #34

The biggest nag I have with tail is that it stops tracking a file once it gets moved and a new one is created in its place (through log rotation).

As mentioned by others in this thread, you can use: "tail -F data.log"

Re: Stop using tail -f (mostly)

#39

Post by protomyth » Mon, Mar 30, 2015, 5:02 PM UTC

nothrabannosir wrote: post #9

Even when you don't want less +F, a good alternative to tail -f is tail -F. It survives log rotation, and the file being temporarily inaccessible: --retry keep trying to open a file even if it is inaccessible when tail starts or if it becomes inaccessible later; useful when follow- ing by name, i.e., with --follow=name -F same as --follow=name --retry

on OpenBSD -f does:

  Do not stop when end-of-file is reached, but rather to wait for
  additional data to be appended to the input.  If the file is re-
  placed (i.e., the inode number changes), tail will reopen the
  file and continue.  If the file is truncated, tail will reset its
  position to the beginning.  This makes tail more useful for
  watching log files that may get rotated.  The -f option is ig-
  nored if the standard input is a pipe, but not if it is a FIFO.

So, no -F or --retry but a different default behavior

Re: Stop using tail -f (mostly)

#40

Post by 64bitbrain » Mon, Mar 30, 2015, 5:03 PM UTC

I use "tail -f" most of the time. Sometimes, I just dig more and use grep with it.

tail -f sys.log | grep NETDEV

But I would definitely give this a try, thanks for sharing.