Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What is difference between tail -f and tailf in unix?

Tags:

unix

tail

I try to show tail of a text file. If file is small, there is no difference. However if file is too big (~5 gB), tailf does not respond. On the other hand tail -f works fine. What is difference between them?

like image 771
umut Avatar asked Mar 31 '15 07:03

umut


People also ask

What is tail f command?

The tail -f command prints the last 10 lines of a text or log file, and then waits for new additions to the file to print it in real time. This allows administrators to view a log message as soon as a system creates it.

What is SVC command?

Use the SVC command to add or update the state of a service status alert in the service. status table for IBM® Tivoli® Composite Application Manager for Internet Service Monitoring.

What is the use of less command in Linux?

The less command is a Linux terminal pager that shows a file's contents one screen at a time. It is useful when dealing with a large text file because it doesn't load the entire file but accesses it page by page, resulting in fast loading speeds.


2 Answers

I have faced the same issue. The log file was about 47GB. The tailf just waits almost infinite. But the tail -f begin to print the output within seconds.

I have digged deeper by examining the underlying system calls using strace command. The results given below:

# strace tailf /var/log/messages

(truncated)
stat("/var/log/messages", {st_mode=S_IFREG|0600, st_size=47432599401, ...}) = 0
open("/var/log/messages", O_RDONLY)     = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=47432600425, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7dba2d1000
read(3, "Nov  1 03:23:01 hostnameXXXX"..., 4096) = 4096
read(3, "0.31.148.12)\nNov  1 03:54:33 del"..., 4096) = 4096
read(3, "io.c(600) [receiver=3.0.6]\nNov  "..., 4096) = 4096
(truncated)

As you can see, the tailf is trying to read (buffer) all the lines from beginning before generating output to the screen.

Check the output of tail -f below, here it is using the system call lseek (C/C++) to directly jump to end of file and start reading from there:

# strace tail -f /var/log/messages

(truncated)
open("/var/log/messages", O_RDONLY)     = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=47294167448, ...}) = 0
lseek(3, 0, SEEK_CUR)                   = 0
lseek(3, 0, SEEK_END)                   = 47294170917
lseek(3, 47294169088, SEEK_SET)         = 47294169088
(truncated)
like image 121
Seff Avatar answered Sep 20 '22 06:09

Seff


From the man page:

   tailf  will print out the last 10 lines of a file and then wait for the
   file to grow.  It is similar to tail -f but does not  access  the  file
   when  it  is not growing.  This has the side effect of not updating the
   access time for the file, so a filesystem flush does not occur periodi-
   cally when no log activity is happening.

http://linuxcommand.org/man_pages/tailf1.html

If it doesn't access the file directly it will have some difficulties with very lage files, depending on your machines setup.

like image 30
Maximilian Kindshofer Avatar answered Sep 20 '22 06:09

Maximilian Kindshofer