1

Is there a way to track which service/file is actively logging to a log file? In this case taking info from the syslog file and creating a file called filtered.log. I'm not seeing a process for this when doing a ps aux but am seeing almost constant logging to this file. Using Ubuntu 16.04.

Thanks.

  • What are you tracking? You seem to know that you want to read a syslog file and write to a filtered.log, so -- what do you want to track, and how? – Jeff Schaller Jan 3 at 13:43
4

I believe the command you are looking for is lsof. From the lsof manual:

lsof - list open files

Under the examples section therein:

To find the process that has /u/abe/foo open, use:

           lsof /u/abe/foo

I have an nginx webserver logging to /var/log/nginx/access.log so I did a test:

$ sudo lsof /var/log/nginx/access.log
[sudo] password for <username>:
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
nginx   1667 root    5w   REG  254,2  7981659 1572890 /var/log/nginx/access.log
nginx   6283 http    5w   REG  254,2  7981659 1572890 /var/log/nginx/access.log
nginx   6284 http    5w   REG  254,2  7981659 1572890 /var/log/nginx/access.log
nginx   6285 http    5w   REG  254,2  7981659 1572890 /var/log/nginx/access.log
nginx   6286 http    5w   REG  254,2  7981659 1572890 /var/log/nginx/access.log

Which seems to be what you are after.

  • 2
    Not all applications write directly to log files, the culprit of the question can be an app sending messages to the syslog daemon. +1 nonetheless – Rui F Ribeiro Jan 3 at 5:25
  • Thanks, good point. But then wouldn't lsof still show that the syslog daemon is writing to the file? It's not a topic I've delved into much before. – cryptarch Jan 3 at 5:56
  • 1
    For sure, but then you would have to use other method to track the actual app sending the messages. T he actual question lacks a sample of the lines in question – Rui F Ribeiro Jan 3 at 8:50
  • Yeah, makes sense – cryptarch Jan 3 at 20:38
  • 1
    Thanks, I found what I was looking for with this. – cycloxr Jan 4 at 5:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.