I have configured rsyslog
to log certain log events to /dev/xconsole
:
*.*;cron.!=info;mail.!=info |/dev/xconsole
/dev/xconsole
is a named pipe (fifo
). If I want to see what is being logged, I can do cat /dev/xconsole
. I am surprised to see, that the command cat /dev/xconsole
does not finish after reading the file, but instead acts as tail -f
. in other words, the two commands behave the same:
cat /dev/xconsole
tail -f /dev/xconsole
Can somebody please explain why is that?
Is there any difference between the two?
Best Answer
cat
keeps reading until it gets EOF. A pipe produces EOF on the output only when it gets EOF on the input. The logging daemon is opening the file, writing to it, and keeping it open — just like it does for a regular file — so EOF is never generated on the output.cat
just keeps reading, blocking whenever it exhausts what's currently in the pipe.You can try this out yourself manually:
And in another terminal:
There will be output in the other terminal. Then:
There will be more output in the other terminal. If you now Ctrl-D the input then the other
cat
will terminate too.In this case, the only observable difference between
cat
andtail -f
will be if the logging daemon is terminated or restarted:cat
will stop permanently when the write end of the pipe is closed, buttail -f
will keep going (reopening the file) when the daemon is restarted.