[TriLUG] tailing forever

[M. Mueller at Signalnetware.com]

I got some great advice on tailing forever from the list a few days ago.  I 
put it all together as follows:

tailing /var/log/messages forever will probably stop working for you after 
about a week (or a day) depending on how often your system rotates the 
logfiles.

In my RH system, in /etc/cron.daily/logrotate I have the following lines:

# rotate the files 
logrotate /etc/logrotate.conf
# stop/start syslogd and klogd; this also kills the current PID of syslogd
# which makes the next command work 
/etc/rc.d/init.d/syslog restart
# tail, follow, until pid of syslogd dies
tail -f --pid=$(cat /var/run/syslogd.pid) /var/log/messages

If anybody sees something screwy here, please call it out.

I am using some modifications from a WAN card developer that gives useful 
printk info into the /var/log/messages; start/stopping klogd solved the 
problem of losing the printk (kernel prints) info to /var/log/messages after 
the logrotate.

Dumping a bunch of stuff into syslog and tailing it forever is a great way to 
slow down a system.  If your syslog just reports important stuff and not too 
often, tailing it forever in a window might be a nice way to keep such 
information at your fingertips.

Still on my TODO list is trying out the fifo capabilities of the syslogger.  
This might be a better way to collect larger volumes of transient debug info 
with less impact on system performance.


-- 
Michael Mueller
Signalnetware, Inc.
www.signalnetware.com
919.621.6090
Converged network solutions using open source tools