tail -f, but when the file is deleted and re-created (not appended)

Question

I'm trying to watch for any new output of a log file. Another script (not under my control) is deleting the file then creating a new one with the same name. Using tail -f doesn't work because the file is being deleted.

If Linux, use -F instead of -f. It's a GNU extension that will follow the file by name and keep retrying. — Andrew Henle, Dec 12 '17 at 17:36
Related: https://unix.stackexchange.com/questions/22698/how-to-do-a-tail-f-of-log-rotated-files — Ciro Santilli OurBigBook.com, Aug 10 '23 at 09:20

Stephen Kitt · Accepted Answer · 2018-10-16T13:36:48.067

41

If your tail supports it, use tail -F, it works nicely with disappearing and re-appearing files. Just make sure you start tail from a directory which will stay in place.

-F is short-hand for --follow=name --retry: tail will follow files by name rather than file descriptor, and will retry when files are inaccessible (e.g. because they’ve been deleted).

(A number of bugs relating to --follow=name with --retry were fixed in coreutils 8.26, so you may run into issues with earlier versions; e.g. retrying when the directory containing the tailed file is deleted appears to only work in all cases with version 8.26 or later.)

edited Oct 16 '18 at 13:36

answered Dec 12 '17 at 17:35

Stephen Kitt

434,908

2

As a side note, less too has a --follow-name option that works in the same way. – dr_ Oct 17 '18 at 09:26
but if files containing that file is removed as well, tail -F prints, that it reverts to polling, but it will never print anything from that time on. – Martin Mucha Oct 10 '19 at 13:05
1

@Martin what version of coreutils are you using? I’ve just checked with 8.30, and tail -F works fine, even if the directory containing the tailed file(s) is deleted (and recreated). As I mention in the answer, a number of issues were fixed in 8.26. – Stephen Kitt Oct 10 '19 at 13:16
my is version 8.31 – Martin Mucha Oct 10 '19 at 15:54

score 4 · Answer 2 · answered Dec 12 '17 at 17:36

Have a look at your tail man command, some have:

--follow=name

which instructs tail to watch for the name, and not the descriptor as it does by default. With such an option, if the file is deleted and recreated, tail will see it. As written in the manual:

With --follow (-f), tail defaults to following the file descriptor, which means that even if a tail'ed file is renamed, tail will continue to track its end. This default behavior is not desirable when you really want to track the actual name of the file, not the file descriptor (e.g., log rotation). Use --follow=name in that case. That causes tail to track the named file in a way that accommodates renaming, removal and creation.

To survive file deletion in all cases, you need --retry, which is what -F does. — Stephen Kitt, Dec 12 '17 at 17:44

tail -f, but when the file is deleted and re-created (not appended)

2 Answers2

Linked