LinuxCommandLibrary

tailf

Track growing log files in real-time

TLDR

View documentation for the recommended replacement

$ tldr tail
copy

SYNOPSIS

tailf [-n N] [-Vh] FILE

PARAMETERS

-n N, --lines=N
    Output the last N lines of the FILE before starting to follow new data. If omitted, tailf typically outputs the last 10 lines by default, similar to tail.

-V, --version
    Display version information for tailf and exit.

-h, --help
    Display a brief help message and exit.

DESCRIPTION

tailf is a command-line utility used to monitor the growth of a file, much like tail -f. Its primary distinction lies in how it interacts with the file: instead of keeping the file continuously open, tailf periodically reopens it, reads new data, and then closes it. This approach offers several advantages, especially when dealing with log files on network file systems (NFS) or highly dynamic environments.

The intermittent file opening behavior reduces resource consumption and can prevent issues related to stale file handles that might occur on NFS. It also makes tailf more resilient to file truncations and certain log rotation schemes, as it will naturally pick up the 'new' file content after a truncation. While modern GNU tail -f implementations have evolved to handle many of these scenarios gracefully (e.g., with options like --follow=name), tailf remains a lightweight and often preferred tool for its specific, robust re-opening mechanism.

CAVEATS

tailf does not inherently follow file renames; it tracks the original inode. If a file is renamed and a new file with the same name is created (a common log rotation strategy), tailf will continue to watch the old, renamed file unless it's explicitly restarted or the old file is removed. Modern GNU tail -f with --follow=name --retry often handles this more robustly. Additionally, tailf's polling nature means it might introduce a slight delay in displaying very rapid updates compared to a continuously open file.

COMPARISON WITH <I>TAIL -F</I>

The key difference between tailf and tail -f lies in their file handling. tail -f (from GNU coreutils) keeps the file descriptor open indefinitely, which is efficient but can cause issues with NFS or when the underlying file is replaced. tailf, by contrast, periodically closes and reopens the file. This makes it more resilient to certain file system events like truncations or when files are moved/deleted by log rotation systems (though not renames of the original file). For most general-purpose log following on local file systems, tail -f is often sufficient and more widely available with a richer set of options. tailf shines in scenarios demanding its specific re-opening behavior.

HISTORY

The tailf utility has historically been part of various Linux distributions, often bundled within packages like sysvinit-utils or util-linux. It emerged as a solution to specific challenges posed by tail -f in older Unix/Linux environments, particularly regarding network file system (NFS) performance and the handling of log file rotations where the file might be truncated or replaced. Its design prioritizes releasing file handles, making it distinct from continuously-open approaches. While advancements in GNU tail have mitigated many of the issues tailf was designed to address, tailf persists as a simple, effective tool for its niche use cases.

SEE ALSO

tail(1), cat(1), less(1), watch(1)

Copied to clipboard