logtail2

logtail2 - print log file lines that have not been read

logtail2 [-t] I -f logfile [-ooffsetfile]

logtail2 reads a specified file (usually a log file) and writes to the standard output that part of it which has not been read by previous runs of R logtail2 . It prints the appropriate number of bytes from the end of R logfile , assuming that all changes that are made to it are to add new characters to it.

logfile must be a plain file. A symlink is not allowed.

logtail2 stores the information about how much of it has already been read in a separate file called R offsetfile . offsetfile can be omitted. If omitted, the file named logfile.offset in the same directory which contains logfile is used by default.

If offsetfile is not empty, the inode of logfile is checked. If the inode is changed, logtail2 uses the heuristics stored in /usr/share/logtail2/detectrotate/ to find a file that might be the rotated logfile and prints it starting with the stored offset. It then proceeds to simply print the entire new file and generates a new offsetfile. If the inode is not changed but logfile is shorter than it was at the last run of R logtail2 , it writes a warning message to the standard output.

-f

-o

-t

successful

65 cannot get the size of R logfile

66 general file or directory access issue

73 cannot write offsetfile

The original logtail was written in C by Craig H. Rowland <crowland@psionic.com>. This version of logtail is a modification of Paul Slootman's re-implementation in perl. enhanced by the Debian Logcheck Team <logcheck-devel@lists.alioth.debian.org>.

This manual was written by Oohara Yuuma <oohara@libra.interq.or.jp> and enhanced by the Debian Logcheck Team <logcheck-devel@lists.alioth.debian.org>..

logcheck(8)