[PLUG] 'logtail' Re: 'logcheck'

[Edmond Rodriguez <erodrig_97@yahoo.com>]

So logcheck has a nice little program included called logtail, which is very nice and simple for tailing a log where you left off the last time you tailed it.  While logtail keeps the inode number of the log, it does not seem to deal with the rotation of the file.  

Logcheck deals with the rotation of a log, and get the last lines of a rotated log along with the lines of a new log file, but is more complex if all the checking it does is not needed. It also has a learning curve.   

Logtail is just one simple program file (I think).  It does not parse, but is simple.

Am I missing something here? Is there a simple canned way to stay simple with logtail, but still deal with the rotation.  I guess I could look at the inode myself, and check to see if a new file exists, then run logtail on the old inode with the recorded offset.  Then run logtail again on the new file. 

Just wanted to mention the program logtail, and also see if I am missing something simple here. 

Edmond



----- Original Message ----
> From: JP Vossen <jp@jpsdomain.org>
> To: plug@lists.phillylinux.org
> Sent: Sunday, March 22, 2009 4:17:35 PM
> Subject: [PLUG] 'logcheck'
> 
> I have said this before but I am a huge fan of the Debian/Ubuntu
> implementation of logcheck.  I am also not aware of any other major 
> distro that makes using logcheck so "built-in" and easy.
> 
> If you run any kind of Debian/Ubuntu server, you really need to be using 
> this.  As soon as something bad or new happens, you get an email.  It's 
> like magic.
> 

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug