On Wed, Feb 22, 2006 at 01:45:02AM -0500, Uri Guttman wrote: > >>>>> "BT" == Ben Tilly <[EMAIL PROTECTED]> writes: > > BT> On 2/21/06, Uri Guttman <[EMAIL PROTECTED]> wrote: > >> >>>>> "JM" == John Macdonald <[EMAIL PROTECTED]> writes: > BT> [...] > JM> Of course, detecting that a log switch of some sort has occurred > JM> doesn't ensure that you will be able to tell if more than one > JM> has occurred "very quickly" (from your frame of reference - > JM> that might mean that your tailing program got paused for a > JM> long time instead). > >> > >> well, most tailing doesn't care about how much has changed. tailing just > >> wants to find and return the appended text. whether it returns large > >> chunks or many lines isn't a function of the log file but of the tailing > >> code. > > BT> I think you're missing John's point. > > BT> His point is that if 2 log switches happen while you're not looking, > BT> all the stuff that was written to the log between those switches is > BT> elsewhere and you'll never realize that it was ever in the log. > > that would entail 2 log rotations in the tailing period. logs usually > rotate by time and some by size. that would be a very unusual log file > to rotate by size twice in a short tail cycle.
Sorry, I replied before noticing Ben's followup and this one - Ben made my point already. > BT> This is not normally an issue. (Typically logs might rotate, say, > BT> once a day. And the tailing process checks every minute or so. But > BT> it theoretically can happen, and there is no good solution for it.) > > then it is just another point about why tailing logs isn't perfect and > can't be unless the OS/FS provides support for this. Yep. This would happen on a size based rotation when there was a heavily repeating logable condition that loaded the system down enough that the tail program was left swapped out for a long time - quite unlikely (but a few orders of magnitude more likely that the new log getting the same inode as the log it replaces, or more since many ways of writing the log rotation would make a duplicate inode impossible to happen in addition to the 65536 to 1 [or longer] odds against it happening if it is possible). -- _______________________________________________ Boston-pm mailing list [email protected] http://mail.pm.org/mailman/listinfo/boston-pm
