LOGTAIL(8)

📦
version 1.4.7build1 · 2 versions
  • 1.4.7build1 · alpine 3.22, alpine 3.23, alpine 3.24, debian bookworm, debian trixie, fedora 43, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 1.3.18 · epel 9
, in alpine 3.22, alpine 3.23, alpine 3.24, debian bookworm, debian trixie, fedora 43, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 LOGTAIL2 — the logtail2 manual, but make it cute ✨

okay bestie, sit down, hydrate, and let me tell you about logtail2, a section 8 (system admin) girlie whose whole personality is "what did the log say while you weren't looking?" 🫶

🌸 NAME 🌸

logtail2 — print log file lines that have not been read. that's it. that's the job. she reads the new stuff and hands it to you. 👑

✨ SYNOPSIS ✨

logtail2 [-t] -flogfile [-ooffsetfile]

🦋 DESCRIPTION 🦋

so here's the vibe: logtail2 reads a file you point at (usually a log file, obviously 💅) and writes to standard output the part of it that previous runs of logtail2 haven't read yet. she prints the appropriate number of bytes from the end of logfile, and she's lowkey assuming the only thing that ever happens to that file is new characters getting appended to it. that's the whole deal. no cap. ✨

logfile has to be a plain file. a symlink? not allowed. nope. absolutely not. 🙅‍♀️

she keeps track of how much she's already read in a separate file called offsetfile. you can omit offsetfile, she's flexible like that. if you do omit it, she defaults to the file named logfile.offset sitting in the same directory that contains logfile. cute, right? 🎀

now this is the part where it gets a lil spicy 🌶️ — if offsetfile isn't empty, she checks the inode of logfile:

  • if the inode changed, she uses the heuristics stored in /usr/share/logtail/detectrotate/ to find a file that might be the rotated logfile, and prints it starting with the stored offset. then she proceeds to simply print the entire new file and generates a new offsetfile. slay, rotation handled. 🔥
  • if the inode did not change but logfile is shorter than it was at the last run of logtail2, she writes a warning message to standard output. like, bestie, that's suspicious. 👀

💅 OPTIONS 💅

  • -f — logfile to be read after offset. the file, the moment, the icon. 🌟
  • -o — offsetfile stores offset of previous run. her little memory notebook. 📓
  • -t — test mode — do not change offset in offsetfile. she's just peeking, not committing. 🙈

💀 RETURN VALUES 💀

she does not do vague. she does numbers. here's the vibe check:

  • 0 — successful ✨ everything ate, no crumbs
  • 65 — cannot get the size of logfile 😭
  • 66 — general file or directory access issue 🚫
  • 73 — cannot write offsetfile 💔

👑 AUTHOR 👑

the original logtail was written in C by Craig H. Rowland <crowland@psionic.com>. this version of logtail is a modification of Paul Slootman's re-implementation in perl, enhanced by the Debian Logcheck Team <logcheck@packages.debian.org>.

this manual was written by Oohara Yuuma <oohara@libra.interq.or.jp> and enhanced by the Debian Logcheck Team <logcheck@packages.debian.org>..

(no but fr fr, thank you legends, we stan 🫶)

🌈 SEE ALSO 🌈

  • logcheck(8) — go read her too, she's the main character of the whole operation 💜
psst — the "assuming that all changes that are made to it are to add new characters to it" thing is doing a LOT of heavy lifting here. don't be weird with your log files and she won't be weird with you. 🧚

and that's the page, bestie!! this little manual comes to you from Debian, dated 28 Jul 2007, and it lives in section 8 of the manual — LOGTAIL(8), periodt. 🎀💖✨

📦 where this page comes from