1###################################################################### 2SYNOPSIS 3-------- 4Logtail is so named because it can be used to read the last few 5messages in a constantly-growing file; but rather than showing a 6fixed proportion of the log, it bookmarks its place and only prints 7out the material added since your last visit. 8 9This utility was originally provided as part of the package 10"logcheck", but can now be installed independently. 11====================================================================== 12BOOKMARKS 13--------- 14Logtail uses an "offsetfile" recording the inode number and length 15in bytes of the file being tailed, then checks this data the next 16time and uses it as a decimal offset to recommence reading from. 17When no offset record exists, a new one is created and the logfile 18is read from the beginning. 19 20Inode information is taken into account so that logtail can detect 21the case where a file has been replaced by another of the same name 22(but probably with different content, so it's all printed) - a 23common effect of logfile rotation. On the other hand a file 24shrinking _without_ moving is a possible symptom of intruders 25covering their tracks, and triggers prominent warnings in the output. 26 27Logtail2, a different executeable, also handles log file rotation by 28guessing a file name that might have been the target of log rotation 29and printing that file's contents starting with the stored offset. If 30you have a non-standard rotation scheme, you can drop your own 31heuristic into %%DATADIR%%/detectrotate/ and have it 32automatically picked up by logtail2. 33====================================================================== 34COMMANDLINE ARGUMENTS 35--------------------- 36See logtail(8) and logtail2(8). 37 38The first, compulsory argument is the name of the input logfile; 39unlike tail, logtail cannot use stdin! 40 41The second, optional argument specifies the filename to which offset 42records should be written. By default it simply adds .offset to the 43name of the input file, which leaves it up to the user to handle 44security issues such as directory write-access; for any serious 45purpose a dedicated offsets directory should be specified. 46###################################################################### 47