Hacker News Reader

Comment by travisgriggs | Hacker News Reader

My addendums:

tail -f

# -f follows live files. Very useful for watching log files from /var/log in real time

grep -Iir “pattern” *

# search local and subdirectories for pattern, skip binary files, case insensitive. Handy for searching whole source trees

tail -f file | grep “pattern”

# useful for live watching very busy logs where you know a specific pattern you’re looking for

find . | grep “filenamepattern”

# search the local directory and down for filenames matching a pattern. Find actually has arguments for doing the search itself, but I know grep already. For more structured types of searches “e.g. I want to find a file named that is of a particular type”, man find

View on HN

To extend a little:

> tail -f

    tail -f filename-to-watch

if looking at a file that might be renamed and stop updating (i.e. log files that are rotated). Without a filename the file descriptor is followed so when for instance access.log becomes access.log.1 your display keeps following access.log.1 not the new access.log which is probably what you want.

> find . | grep

I add “-type f” to find's params when doing that, as I'm almost invariably doing something that I don't want to apply to sub-directories (just the files within them).

Also if sending the file list to grep for searching the contents not the names:

    find . -type f -print0 | xargs -0 grep options-and-stuff-to-find

which deals with the common issue of spaces in filenames. Or you can do

    find . -type f -exec grep stuff-to-find {} \;

to avoid the extra invocation of xargs, but I consider this less beginner-friendly (you have to remember the “;” and that it usually needs to be escaped or the shell will take it as an end of statement marker and not pass it to find, the error message “missing argument to `-exec'” received when you forget it not particularly helpful IMO if you don't know _or_ temporarily draw a mental blank).

As a note,

    find . -type f -exec grep stuff {} \;

will also invoke a new grep process for every file, which can be slow. If you think find is going to return a lot of files, it is often better to use

    find . -type f -exec grep stuff {} +  # note plus sign

which will replace {} with as many filenames as allowed (all correctly quoted, etc).

Ah, yes, the other reason not to use that form: remembering to use + instead of ; for efficiency! No point removing xargs just to add in many more invocations of the target command.

> if looking at a file that might be renamed and stop updating (i.e. log files that are rotated). Without a filename the file descriptor is followed so when for instance access.log becomes access.log.1 your display keeps following access.log.1 not the new access.log which is probably what you want.

I believe that's true if you name a file as well (just tested it on Ubuntu). You keep following the original file you named, even if it becomes renamed; you don't follow a new file by the same name.

Using something like "watch -n5 tail filename" polls every few seconds to show the bottom of a file, and goes for the current file at that filename each time.

`tail -F` is what you're looking for. No need to implement it manually with `watch`.

TIL! Thanks

Ah, checking the man-page it would seem that you need to use the long-form option for the behaviour I described to work:

    tail --follow=file-to-follow-by-name

> watch -n5 tail filename

That works too, and for many other uses, but doesn't allow scroll-back which can be significant when a lot of information comes through at once.

--follow does not take a file name.

There is no difference between long and short options, at least not in this case.

The manpage appears to differ on those facts: https://manpages.debian.org/bullseye/coreutils/tail.1.en.htm...

"Use --follow=name in that case. That causes tail to track the named file in a way that accommodates renaming, removal and creation."

I will test to be extra sure when I have a few minutes spare.

Nothing in that sentence says that --follow takes a filename. `name` in that sentence is not a standin for a filename.

Ah, yes. It looks like I was combining misreading with misremembering, wronging mashing “tail -f some-file” and “tail --follow=name some-file” into “tail --follow=some-file”.

Though there is a difference between the short and long forms as -f can't take the extra parameter. “-f=name” is incorrect as it takes “=” to be a short-form option and “-f name” also as it takes “name” to be one of the objects to tail. As per the manpage and --help, for that behaviour you need “-F”. As well as meaning “--follow=name” that also implies “--retry”, though I can't think of a circumstance where this would be a problem.

I used to use find and grep together but find is really so easy to use by itself:

    find . -name 'filenamepattern'

The only difference is it's a glob, not a regex.

Really fgrep (or grep -F) should be used if there's no need for grep magic.

Reply on news.ycombinator.com