Logs – Monitor Files in Entire Directory Including New Ones

logstail

I normally watch many logs in a directory doing tail -f directory/*.
The problem is that a new log is created after that, it will not show in the screen (because * was expanded already).

Is there a way to monitor every file in a directory, even those that are created after the process has started?

Best Answer

You can tail multiple files with… multitail.

multitail -Q 1 'directory/*'

-Q 1 PATTERN means to check for new content in existing or new files matching PATTERN every 1 second. Lines from all files are shown in the same window, use -q instead of -Q to have separate windows.

Related Solutions

Is it fine to use tail -f on large log files

On my linux system (GNU coreutils 8.12), I was able to check (using strace) that tail -f¹ uses the lseek system call to skip over most of the file quickly:

lseek(3, 0, SEEK_CUR)                   = 0
lseek(3, 0, SEEK_END)                   = 194086
lseek(3, 188416, SEEK_SET)              = 188416

This means that the size of the tracked file should not matter in anyway.

Maybe you can check if the same applies on your system. (Obviously, it should be the case.)

—
^{1. I also tried disabling inotify support with the undocumented ---disable-inotify, just in case.}

Solaris Logs – How to Less a Filename Rather Than an Inode Number

Use less --follow-name if your version of less supports it.
That option was introduced in version 416.

Then do a normal follow command Shift+F within less.

Best Answer

Related Solutions

Is it fine to use tail -f on large log files

Solaris Logs – How to Less a Filename Rather Than an Inode Number

Related Question