Ever need to read a file that is being appended to while reading it?
The first command we usually learn for following a log file is
tail -f. Works great; until the line in the log we're looking for scrolls right past us and out of the buffer.
Another handy command in our tool box for reading log files is
less. As a pager program
less allows us to navigate around and search for strings.
less has a feature that is not well documented which allows us to follow a log file just like using
tail -f, with the added benefit of file navigation and search. A file such as a web server access log, or an application debug log, is a great option to see this real-time appending in action.
$ less /var/log/foo.log
Basic navigation now is as simple as using the up/down arrows or the letters
k. This is basic functionality, well documented in the
less man pages.
Quickly jump to the end of the file
shift + g : While in the standard page view of a file jump to the end of the file
log text line
log text line
last line of log on this page
<shift + g>
jump to last line in the file
We're at the end of the file, but we care about what is being appended to the file right now, and all we see is the last line written to the file when we opened it.
The magic mystery command:
shift + f puts us into follow mode. Now we have the same functionality as
tail -f, with more power. Now we can observe the real-time content appended to the log file we're reading.
Search the File
To return to standard pager mode we use
ctrl + c. In this mode we can use the search features in less:
/<search term> : searches forward in the file for <search term>; highlights located term
?<search term> : searches backward in the file for <search term>; highlights the located term
n : finds the next location of <search term> in the direction you are searching
shift + n : finds the previous location of <search term> in the opposite direction you are searching
Follow the term
After we enter search mode, whenever the term appears in the log it will be highlighted. Jumping forward and backward in the file, the term remains highlighted. Let's use that to help watch the logs for our search term while the log is being written.
shift + g jumps us the end of the file, then we
shift + f to follow. Now as the log is appended with real-time activity we can watch the file for our search term, it will be highlighted.
ctrl + c : cancel follow mode
shift + n : search backward in the file for our search term