Sunday, 31 January 2010

inotail - tail clone using inotify

I regularly use the tail command to look at the end of log files - generally I use the -f flag to follow (monitor and display) new entries that are appended to the log.

Tail will poll every second to see if the file size is changed and will act if data has been appended or the file has been truncated, and the poll interval is adjustable.  However, polling a file is plain ugly, it causes extra wakeup events and if one wants very fast updates then polling is not a good solution.

Hence, a better tool to use is inotail when following a file. Inotail uses inotify to only wake up inotail when a file has been modified, deleted or moved - hence no polling is required.  This also means inotail will output the changes to a file almost immediately - unlike tail which by default may wait almost a second before detecting a change.

To install inotail use:

sudo apt-get install inotail

..and use it the same was as tail.

UPDATE:  Pete Graner has also informed me that the tailf command is also an inotify based tail -f like replacement too. Just goes to show there are many ways of doing the same thing...

2 comments:

  1. Why doesn't the normal tail do this?

    ReplyDelete
  2. @Pepsiman,

    The normal tail polls periodically using fstat() to see if the file has changed size. Run strace on it doing a tail -f and watch it polling away once a second.

    ReplyDelete