Re: Confused: 'tail -f' how can this happen???

[Athanasius <link@miggy.org>]

On Fri, Jul 25, 2008 at 03:37:10PM -0600, Reg Clemens wrote:
> OK, I dont understand this at all.
> I was debugging another problem, and had a 'tail -f' running on my maillog 
> file.
> It showed data down to the  present, namely 15:18:18

  What date ?

> Something had gone by fast enough that I brought the maillog up in an editor
> but IT only showed data down to 14:02:16

  And what date here ?

> Looking at the 'ls' of /var/log, the maillog file shows a write date of 14:02.
> 
> If I do a 2nd tail -f, it too stops at 14:02.

  And here ?

> What is going on with the file system to cause the bizare behaviour?
> Why cant I see ALL the data in maillog, or why could I see it only once?
> 
> Confused.

   I'm hoping this is as simple as:

	1) You opened the initial tail on one day and left it running
	2) Log rotation happens, mail software, via syslog or directly,
	starts logging to the new 'maillog', the other one now being
	'maillog.1' or whatever
	3) You don't realise this and get confused by the differing data
	when you look afresh at what is now 'maillog'

And of course, depending on local configuration, maybe your maillog
rotates more often than once a day (although that alone wouldn't explain
the 'gone backwards' timestamp).

HTH,

-Ath
-- 
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME