mbucc / retail Goto Github PK

1.0 3.0 2.0 504 KB

A stateful tail that recognizes log rotations.

Prolog 0.16% Makefile 9.03% Groff 16.04% Shell 17.76% C 57.01%

retail's Introduction

RETAIL(1)                 BSD General Commands Manual                RETAIL(1)

NAME
     retail -- display the additions to a file since previous retail run

SYNOPSIS
     retail [-o datafile] file

DESCRIPTION
     The retail utility displays the lines added to file since the last run to
     stdout.

     After each run, the retail utility stores the most recent size, byte off-
     set and inode of file. By default, this information is stored in the same
     directory as file and with the same name as file except with the prefix
     ``offset.'  For example, if the file is ``syslog'', the offset data will
     be stored in a file named ``offset.syslog''.

     The utility accepts one option:

     -o datafile
          The datafile option lets you specify where to store the data from
          the last run.  If the option specifies a file, the data is stored in
          that file.  If a directory, the data is stored in that directory,
          using the default file name described above.

     In some cases, retail will notice that the file has been rotated and tail
     the rotated file before tailing the current file.

     Specifically, if the inode of the file is unchanged and the file is
     smaller, retail assumes the file was rotated via a copy and truncate.
     The utility looks for files (in the same directory) that match the file
     name and takes the most recently modified one.  For example, if the file
     name is ``syslog'', and the same directory has the files ``syslog.1'' and
     ``syslog.2'', retail will assume the most recently modified of the two is
     the rotated file.

     If the inode is different, retail assumes the file was rotated via a move
     and recreate, and looks for a file with the old inode.  If it can't find
     one, retail assumes the old file was gzipped after the move and looks for
     the most recently changed file in the same directory with a name that
     starts with the file name and ends with ``.gz''.

     If neither of these conditions apply, then retail does not try to find a
     rotated file.

EXIT STATUS
     The retail utility returns 0 on success and 1 if an error occurs.

EXAMPLES
     To retail syslog and store the offset data in ``/var/db/retail/off-
     set.syslog''.

           $ retail -o /var/db/retail/ /var/log/syslog

SEE ALSO
     tail(1), http://sourceforge.net/projects/logtail-v3/,
     http://ranum.com/security/computer_security/code/index.html

HISTORY
     Initially published by Craig H. Rowland in 1996.  He got the idea from
     the retail utility, which came with Trusted Information Systems' Gaunt-
     let(TM) firewall protection package.  Marcus Ranum (second link above in
     SEE ALSO section) was the author of the original retail.

BSD                            February 5, 2015                            BSD

retail's People

Contributors

Stargazers

Watchers

Forkers

jtobey

retail's Issues

Store tail data in ASCII format

No advantage to using binary. It's good to be able to read files with standard tools.

We may also want to store last retail date. Though not used, it would be useful looking through data files.

Somehow offset was greater than length

retail: last offset (5732) greater than last size (5626) in '/home/logbot/offsets/offset.auth.log'

One message, after many months of running this live. Try to figure out how this happened.

I looked at auth.log and it looked fine; no missing lines. Maybe add extra logging in case it happens again?

Doesn't build on Ubuntu Lucid

apt-get install zlib1g-dev

make

gcc -lz -o retail retail.c
retail.c: In function 'dump_changes':
retail.c:184: error: invalid initializer
retail.c:193: error: incompatible type for argument 2 of 'gzseek'
/usr/include/zlib.h:1388: note: expected 'off_t' but argument is of type 'fpos_t'
retail.c:206: error: invalid operands to binary + (have 'fpos_t' and 'unsigned int')
retail.c: In function 'check_log':
retail.c:267: error: invalid operands to binary > (have 'fpos_t' and 'off_t')
retail.c:269: warning: format '%lld' expects type 'long long int', but argument 3 has type 'fpos_t'
retail.c:269: warning: format '%lld' expects type 'long long int', but argument 4 has type 'off_t'
retail.c:305: error: incompatible types when assigning to type 'fpos_t' from type 'int'
retail.c:308: error: invalid operands to binary + (have 'fpos_t' and 'fpos_t')
make: *** [retail] Error 1

mbucc / retail Goto Github PK

retail's Introduction

retail's People

Contributors

Stargazers

Watchers

Forkers

retail's Issues

Store tail data in ASCII format

Somehow offset was greater than length

Doesn't build on Ubuntu Lucid

apt-get install zlib1g-dev

make

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent