1######################################################################
2SYNOPSIS
3--------
4Logtail is so named because it can be used to read the last few
5messages in a constantly-growing file; but rather than showing a
6fixed proportion of the log, it bookmarks its place and only prints
7out the material added since your last visit.
8
9This utility was originally provided as part of the package
10"logcheck", but can now be installed independently.
11======================================================================
12BOOKMARKS
13---------
14Logtail uses an "offsetfile" recording the inode number and length
15in bytes of the file being tailed, then checks this data the next
16time and uses it as a decimal offset to recommence reading from.
17When no offset record exists, a new one is created and the logfile
18is read from the beginning.
19
20Inode information is taken into account so that logtail can detect
21the case where a file has been replaced by another of the same name
22(but probably with different content, so it's all printed) - a
23common effect of logfile rotation.  On the other hand a file
24shrinking _without_ moving is a possible symptom of intruders
25covering their tracks, and triggers prominent warnings in the output.
26
27Logtail2, a different executeable, also handles log file rotation by
28guessing a file name that might have been the target of log rotation
29and printing that file's contents starting with the stored offset. If
30you have a non-standard rotation scheme, you can drop your own
31heuristic into %%DATADIR%%/detectrotate/ and have it
32automatically picked up by logtail2.
33======================================================================
34COMMANDLINE ARGUMENTS
35---------------------
36See logtail(8) and logtail2(8).
37
38The first, compulsory argument is the name of the input logfile;
39unlike tail, logtail cannot use stdin!
40
41The second, optional argument specifies the filename to which offset
42records should be written.  By default it simply adds .offset to the
43name of the input file, which leaves it up to the user to handle
44security issues such as directory write-access; for any serious
45purpose a dedicated offsets directory should be specified.
46######################################################################
47