What is difference between tail -f and tailf in unix?
I have faced the same issue. The log file was about 47GB. The tailf
just waits almost infinite. But the tail -f
begin to print the output within seconds.
I have digged deeper by examining the underlying system calls using strace
command. The results given below:
# strace tailf /var/log/messages(truncated)stat("/var/log/messages", {st_mode=S_IFREG|0600, st_size=47432599401, ...}) = 0open("/var/log/messages", O_RDONLY) = 3fstat(3, {st_mode=S_IFREG|0600, st_size=47432600425, ...}) = 0mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7dba2d1000read(3, "Nov 1 03:23:01 hostnameXXXX"..., 4096) = 4096read(3, "0.31.148.12)\nNov 1 03:54:33 del"..., 4096) = 4096read(3, "io.c(600) [receiver=3.0.6]\nNov "..., 4096) = 4096(truncated)
As you can see, the tailf
is trying to read (buffer) all the lines from beginning before generating output to the screen.
Check the output of tail -f
below, here it is using the system call lseek
(C/C++) to directly jump to end of file and start reading from there:
# strace tail -f /var/log/messages(truncated)open("/var/log/messages", O_RDONLY) = 3fstat(3, {st_mode=S_IFREG|0600, st_size=47294167448, ...}) = 0lseek(3, 0, SEEK_CUR) = 0lseek(3, 0, SEEK_END) = 47294170917lseek(3, 47294169088, SEEK_SET) = 47294169088(truncated)
From the man page:
tailf will print out the last 10 lines of a file and then wait for the file to grow. It is similar to tail -f but does not access the file when it is not growing. This has the side effect of not updating the access time for the file, so a filesystem flush does not occur periodi- cally when no log activity is happening.
http://linuxcommand.org/man_pages/tailf1.html
If it doesn't access the file directly it will have some difficulties with very lage files, depending on your machines setup.