Is it possible to do a
tail -f (or similar) on a file, and
grep it at the same time? I wouldn't mind other commands just looking for that kind of behavior.
It will work fine; more generally,
grep will wait when a program isn't outputting, and keep reading as the output comes in, so if you do:
$ (echo foo; sleep 5; echo test; sleep 5) | grep test
Nothing will happen for 5 seconds, then grep will output the matched "test", and then five seconds later it will exit when the piped process does
I see all these people saying to use
tail -f, but I do not like the limitations of that! My favorite method of searching a file while also watching for new lines (e.g., I commonly work with log files to which are appended the redirected output of processes executed periodically via cron jobs) is:
tail -Fn+0 /path/to/file|grep searchterm
This assumes GNU tail and grep. Supporting details from the tail manpage (GNU coreutils, mine is v8.22) [https://www.gnu.org/software/coreutils/manual/coreutils.html] :
-F same as --follow=name --retry -n, --lines=K output the last K lines, instead of the last 10; or use -n +K to output starting with the Kth. If the first character of K (the number of bytes or lines) is a '+', print beginning with the Kth item from the start of each file, otherwise, print the last K items in the file. K may have a multiplier suffix: b 512, kB 1000, K 1024, MB 1000*1000, M 1024*1024, GB 1000*1000*1000, G 1024*1024*1024, and so on for T, P, E, Z, Y. With --follow (-f), tail defaults to following the file descriptor, which means that even if a tail'ed file is renamed, tail will continue to track its end. This default behavior is not desirable when you really want to track the actual name of the file, not the file descriptor (e.g., log rotation). Use --follow=name in that case. That causes tail to track the named file in a way that accommodates renaming, removal and creation.
So, the tail portion of my command equates to
tail --follow --retry --lines=+0, where the final argument directs it to start at the beginning, skipping zero lines.
You can use netcat to grep the results of tail -f as new results come in quite easily.
sudo nc -s localhost -l -p 1337 | grep ssh tail -f /var/log/file.log | nc 127.0.0.1 1337
This sets grep to listen to results for input coming from port 1337.
The second command pipes the output of tail -f to netcat and sends it out localhost 1337. To do it locally you need to switch ttys for each of the two sets of commands, or use something like screen.