[Logcheck-devel] Bug#406973: logtail misses lines in rotated file

[Nicolas Boullis]

Hi,

Christoph Berg wrote:
> Re: Nicolas Boullis 2007-01-15 <20070115110250.GA1867 at kheops.system.ecp.fr>
> 
>>The attached patch allows to set an alternate logfile that logtail tries
>>to use as the old logfile if the inode has changed.
>>It can be used as:
>>  logtail -f /var/log/syslog -a /var/log/syslog.1
> 
> It would be nice if the "other" filename could be figured out
> automatically, for example with logrotate's "dateext" or savelog's -d
> option, the filename is not predictable. (Just scan the whole dir and
> look for the file with the right inode.)

Sounds like a good idea. But my knowledge of Perl is so limited that I
probably can't implement it myself. I also think it might be a better
idea to use a different option for scanning.
AN other way to solve your problem might be to use a hardlink:
/var/log/syslog.last would be the /var/log/syslog you last read. If they
differ (different inodes), read the end of syslog.last, then all syslog
and then create a new hardlink. Note that this would even work if the
logfile gets compressed.


Cheers,

Nicolas