tail -f always displays “Killed”

Question

When doing

tail -f /var/log/apache2/access.log

It shows logs and then

Killed

I have to re-execute tail -f to see new logs.

How do I make tail -f continually display logs without killing itself?

Answer 1

The first thing I'd do is try --follow instead of -f. Your problem could be happening because your log file is being rotated out. From the man page:

With --follow (-f), tail defaults to following the file descriptor, which means that even if a tail'ed file is renamed, tail will continue to track its end. This default behavior is not desirable when you really want to track the actual name of the file, not the file descriptor (eg, log rotation). Use --follow=name in that case. That causes tail to track the named file in a way that accommodates renaming, removal and creation.*

Answer 2

tail -f should not get killed.

Btw, tail does not kill itself, it is killed by something. For example system is out of memory or resource limit is too restrictive.

Please figure out what kills your tail, using for example gdb or strace . Also check your environment, at least ulimit -a and dmesg for any clues.

Answer 3

If your description is correct, and tail actually displays

Killed

then it is probably not happening as a result of log rotation. Log rotation will causes tail to stop displaying new lines, but even if the file is deleted, tail will not be killed.

Rather, some other process on the system, or perhaps the kernel, is sending it a signal 9 (SIGKILL). Possible causes for this include:

• A user in another terminal issuing a command such as kill -9 1234 or pkill -9 tail

• Some other tool or daemon (although I can't think of any that would do this)

• The kernel itself can send SIGKILL to your process. One scenario under which it would do this is if the OOM (Out of memory) killer kicked in. This happens when all RAM and swap in the system is used. The kernel will select a process which is using a lot of memory and kill it. If this was happening it would be visible in syslog, but it is quite unlikely that tail would use that much memory.

• The kernel can send you SIGKILL if RLIMIT_CPU (the limit on the amount of CPU time your process has used) is exceeded. If you leave tail running for long enough, and you have a ulimit set, then this can happen. To check for this (and other resource limitations) use ulimit -a

In my opinion, either the first or last of these explanations seems most likely.

Answer 4

您需要使用tail -F logfile ，如果日志文件旋转，它将不会终止。