I am trying to extract data from a very rapidly changing log file. I would like to sample this file every 5 minutes and get the most recent 5 minutes worth of data. I don't really want to write a tail program myself. I am a firm believer of not re-inventing the wheel.

I had hoped to used File::Tail, or better yet File::Tail::App to perform the tail so I could focus on the parsing and reporting. I really like the lastrun capability of File::Tail::App and thought I could exploit that to help control the data sampling. However, I think that my data is changing too rapdily for this. Not long after I start the script, the lastrun file becomes zero length and the tail behaves like a unix tail -f. I think that because the existence of an EOF is so fleeting, that from the program's perspective there isn't one and so it continues to read.

What I'm wondering is if there is a way for me to tell File::Tail:App or the underlying File::Tail where I want it to stop. I could easily tell it the file size in bytes and therefore a place where it could end. But as far as I can tell there is no provision for a second seek value to denote the end of the data.

Am I just trying to ask these tail modules to do something they can't? Do I need to write my own tail functionality using seek or sysseek?. My test code at this point is nothing more that the example provided with the File::Tail::App module documentation but used on one of my log files. I haven't even started on the parsing logic.

#!/usr/bin/perl
use strict;
use warnings;
use Unix::PID '/var/run/tail.pid';
use File::Tail::App qw(tail_app);

   tail_app({
      'new'          => ['my.log'],
      'line_handler' => \&_wag_tail,
      'lastrun_file' => 'x.lastrun',
   });

   sub _wag_tail {
      my($line) = @_;
     print "$line \n";
   }

[download]

In reply to Tail a rapidly changing file by rah

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.