[Logcheck-devel] Bug#406973: logtail misses lines in rotated file

[Nicolas Boullis]

Package: logtail
Version: 1.2.52
Severity: normal
Tags: patch

Hi,

When a logfile is rotated, logtail misses the lines logged between the
last logtail run and the logfile rotation.
The attached patch allows to set an alternate logfile that logtail tries
to use as the old logfile if the inode has changed.
It can be used as:
  logtail -f /var/log/syslog -a /var/log/syslog.1

(Please note that this is a quick'n'dirty patch, by someone who knows
very little perl.)


Cheers,

Nicolas


-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.4.27-2-686
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages logtail depends on:
ii  perl                       5.8.4-8sarge5 Larry Wall's Practical Extraction 
-------------- next part --------------
--- logtail.orig	2006-12-28 13:35:10.000000000 +0100
+++ logtail	2007-01-15 11:54:45.000000000 +0100
@@ -27,7 +27,7 @@
 
 # process args and switches
 my ($TEST_MODE) = 0;
-getopts("f:o:t", \%opts);
+getopts("f:o:a:t", \%opts);
 
 # try to detect plain logtail invocation without switches
 if (!$opts{f} && $#ARGV != 0 && $#ARGV != 1) {
@@ -80,6 +80,20 @@
         print STDERR "Cannot get $logfile file size.\n", $logfile;
         exit 65;
     }
+    
+    if ($inode != $ino && $opts{a}) {
+        if (open(ALTFILE, $opts{a})) {
+            my ($alt_ino, $alt_size) = (0, 0);
+            if ((undef,$alt_ino,undef,undef,undef,undef,undef,$alt_size) = stat $opts{a}) {
+                if ($inode == $alt_ino && $offset < $alt_size) {
+                    seek(ALTFILE, $offset, 0);
+                    while(<ALTFILE>) {
+                        print $_;
+                    }
+                }
+            }
+        }
+    }
 
     if ($inode == $ino) {
         exit 0 if $offset == $size; # short cut