Re: Reading only new lines from a file

Are you sure that the log rotation isn't being done with a cp isn't of a mv for the log file that is currently being written too? Your code is written with the expectation that the log rotation software is performing the equivalent of an mv command, i.e. copy the file to a new name and the delete the old file.

It possible (and better) that the log rotation software is taking the following steps to rotate the logs;

$ mv logfile.2 logfile.3
$ mv logfile.1 logfile.2
$ cp logfile logfile.1
$ >logfile

For this example, only three old log files are being kept.

The last step will truncate the logfile to 0 bytes but doesn't cause a new file to be created so the inode number will not change. This is a better method because the process that is writing to the log file doesn't need to be restarted (or HUP'd).

Depending upon the frequency of the monitoring of the log file, just keeping track of the size of the file will allow you to know that the file has been truncated. If the file size is smaller than it was last time, you can be confident that the file has been truncated and you need to display all of it. Of course there is the risk that if the file is being written to quickly, this method won't pick up all of the changes.

Comment on Re: Reading only new lines from a file

Replies are listed 'Best First'.
Re^2: Reading only new lines from a file by dsheroh (Monsignor) on Sep 01, 2007 at 01:32 UTC
That's a mildly annoying possibility (just by virtue of opening the possibility that an attempt to detect rotation could be foiled by, say, a slashdotting following a slow day), although I do see the advantage in doing it that way. Thanks for bringing it up.	[reply]
Re^3: Reading only new lines from a file by bruceb3 (Pilgrim) on Sep 01, 2007 at 01:47 UTC
To detect a log file rotation you could keep track of the inode number of logfile.2 but it would be necessary to examine the inode number more frequently that the log rotation software runs.	[reply]