I try to show tail of a text file. If file is small, there is no difference. However if file is too big (~5 gB), tailf does not respond. On the other hand tail -f works fine. What is difference between them?
The tail -f command prints the last 10 lines of a text or log file, and then waits for new additions to the file to print it in real time. This allows administrators to view a log message as soon as a system creates it.
Use the SVC command to add or update the state of a service status alert in the service. status table for IBM® Tivoli® Composite Application Manager for Internet Service Monitoring.
The less command is a Linux terminal pager that shows a file's contents one screen at a time. It is useful when dealing with a large text file because it doesn't load the entire file but accesses it page by page, resulting in fast loading speeds.
I have faced the same issue. The log file was about 47GB. The tailf
just waits almost infinite. But the tail -f
begin to print the output within seconds.
I have digged deeper by examining the underlying system calls using strace
command. The results given below:
# strace tailf /var/log/messages
(truncated)
stat("/var/log/messages", {st_mode=S_IFREG|0600, st_size=47432599401, ...}) = 0
open("/var/log/messages", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=47432600425, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7dba2d1000
read(3, "Nov 1 03:23:01 hostnameXXXX"..., 4096) = 4096
read(3, "0.31.148.12)\nNov 1 03:54:33 del"..., 4096) = 4096
read(3, "io.c(600) [receiver=3.0.6]\nNov "..., 4096) = 4096
(truncated)
As you can see, the tailf
is trying to read (buffer) all the lines from beginning before generating output to the screen.
Check the output of tail -f
below, here it is using the system call lseek
(C/C++) to directly jump to end of file and start reading from there:
# strace tail -f /var/log/messages
(truncated)
open("/var/log/messages", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=47294167448, ...}) = 0
lseek(3, 0, SEEK_CUR) = 0
lseek(3, 0, SEEK_END) = 47294170917
lseek(3, 47294169088, SEEK_SET) = 47294169088
(truncated)
From the man page:
tailf will print out the last 10 lines of a file and then wait for the
file to grow. It is similar to tail -f but does not access the file
when it is not growing. This has the side effect of not updating the
access time for the file, so a filesystem flush does not occur periodi-
cally when no log activity is happening.
http://linuxcommand.org/man_pages/tailf1.html
If it doesn't access the file directly it will have some difficulties with very lage files, depending on your machines setup.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With