I would like to do the following to monitor for a pattern in a log file:

tail -f ./app.log | grep "My Pattern: .*" >> ./MyPattern.txt &

This is working fine until the app.log reaches 500MB and it is moved to be app-2015-10-28.0.log and a new app.log is created. When this happens the tail -f will stop working. Stopping and running the same command again will work, but in between stopping and starting, the pattern that appears in between the restarting may be missed.

Another condition of rolling is when it is 00:00. The same rolling will happen even when the log is < 500MB.

Log rolling is done at application level and we cannot control that part.

How can we detect the log has been rolled, without missing the patterns of interest?


1 Answer 1


tail normally follows the file descriptor (--follow=descriptor), which becomes inaccessible when the log file is rolled or the file is moved away. See this from the man page of tail:


keep trying to open a file even when it is or becomes inaccessible; useful when following by name, i.e., with --follow=name

So use it like this (tail follows the name not the descriptor now):

tail --follow=name --retry logfile | grep "pattern"

You will see in tails output, when the file gets truncated or moved away:

$ tail --follow=name --retry logfile
tail: logfile: file truncated
tail: `logfile' has become inaccessible: No such file or directory
tail: `logfile' has appeared;  following end of new file

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .