Logcheck devel - Jan 2007 - Bug#406973: logtail misses lines in rotated file

Package: logtail
Version: 1.2.52
Severity: normal
Tags: patch

Hi,

When a logfile is rotated, logtail misses the lines logged between the
last logtail run and the logfile rotation.
The attached patch allows to set an alternate logfile that logtail tries
to use as the old logfile if the inode has changed.
It can be used as:
  logtail -f /var/log/syslog -a /var/log/syslog.1

(Please note that this is a quick'n'dirty patch, by someone who knows
very little perl.)


Cheers,

Nicolas


-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.4.27-2-686
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages logtail depends on:
ii  perl                       5.8.4-8sarge5 Larry Wall's Practical
Extraction
-------------- next part --------------
--- logtail.orig	2006-12-28 13:35:10.000000000 +0100
+++ logtail	2007-01-15 11:54:45.000000000 +0100
@@ -27,7 +27,7 @@
 
 # process args and switches
 my ($TEST_MODE) = 0;
-getopts("f:o:t", \%opts);
+getopts("f:o:a:t", \%opts);
 
 # try to detect plain logtail invocation without switches
 if (!$opts{f} && $#ARGV != 0 && $#ARGV != 1) {
@@ -80,6 +80,20 @@
         print STDERR "Cannot get $logfile file size.\n", $logfile;
         exit 65;
     }
+    
+    if ($inode != $ino && $opts{a}) {
+        if (open(ALTFILE, $opts{a})) {
+            my ($alt_ino, $alt_size) = (0, 0);
+            if ((undef,$alt_ino,undef,undef,undef,undef,undef,$alt_size) = stat
$opts{a}) {
+                if ($inode == $alt_ino && $offset < $alt_size) {
+                    seek(ALTFILE, $offset, 0);
+                    while(<ALTFILE>) {
+                        print $_;
+                    }
+                }
+            }
+        }
+    }
 
     if ($inode == $ino) {
         exit 0 if $offset == $size; # short cut

Re: Nicolas Boullis 2007-01-15 <20070115110250.GA1867 at
kheops.system.ecp.fr>
> The attached patch allows to set an alternate logfile that logtail tries
> to use as the old logfile if the inode has changed.
> It can be used as:
>   logtail -f /var/log/syslog -a /var/log/syslog.1
It would be nice if the "other" filename could be figured out
automatically, for example with logrotate's "dateext" or
savelog's -d
option, the filename is not predictable. (Just scan the whole dir and
look for the file with the right inode.)

Christoph Berg
-- 
Tel.: +49 (0)21 61 / 46 43-0
credativ GmbH, HRB M?nchengladbach 12080
Hohenzollernstr. 133, 41061 M?nchengladbach
Gesch?ftsf?hrung: Dr. Michael Meskes, J?rg Folz
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url :
http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20070809/dc8c169e/attachment.pgp