Log Monitoring with Tail – How to Continuously Monitor Logs with Tail That Are Occasionally Rotated

linuxlog-fileslogrotatemonitoringtail

We're using tail to continuously monitor several logs, but when a log is rotated the tail for that file will cease.

As far as I understand, the problem is that when the log is rotated, there is a new file created, and the running tail process doesn't know anything about that new file handle.

Best Answer

Ah, there's a flag for this.

instead of using tail -f /var/log/file we should be using tail -F /var/log/file

tail -F translates to tail --follow=name --retry as in;

--follow=name: follow the name of the file instead of the file descriptor
--retry: if the file is inaccessible, try again later instead of dying

Related Solutions

Where does logrotate save its own log

logrotate does not log anything by default. normally it should be in your cron somewhere, for instance:

$ grep -r -- 'logrotate.conf' /etc/cron*
/etc/cron.daily/logrotate:/usr/sbin/logrotate /etc/logrotate.conf

You can either run that manually to see what is wrong, or redirect the logrotate output to a file in the above cron to see what happened next day.

Likely somewhere the config is incorrect and caused the logrotate run to break.

Centos – Compress logs rotated with cronolog

Logrotate really is the tool for this job but if you can't use it then you could use find and the -ctime patameter

find /var/logs/httpd/my.example.host.com/ -ctime +0 -not -name '*.gz' -exec gzip {} \;

should do what you want as it finds files that were changed >24hours ago that arean't already compressed and compresses them.

To ensure the file you are working on isn't still open you could do something like

#!/bin/bash
for file in $(find /var/logs/httpd/my.example.host.com/ -ctime +0 -not -name '*.gz')
do
    lsof | grep $file
    if [$? -eq 1 ]
    then
        gzip $file
    fi
done

Best Answer

Related Solutions

Where does logrotate save its own log

Centos – Compress logs rotated with cronolog

Related Topic