Tail -f alternative ?

Which console.log are you using tail on.
HD/Library/Logs/Console/console.log
does have have user privileges.

HD/Library/Logs/Console/ UserName/console.log
is accessible.
Also to what location are your writing the output? That could also be a problem.

I think your problem is that stdout is buffered. The output of tail is buffered, and grep isn't going to see any input until the buffer is flushed. That won't occur until either the buffer is full, or the program feeding the pipe exits. But tail -f doesn't exit. The log jam continues. If and when grep finally does see some input, its output is also buffered. Nothing's going to show up in your output file until the buffer is full, or the program feeding grep exits so that grep can exit.

I don't think you're going to have much luck doing what you want with a shell script. Not enough control over io buffering. I don't think it'd be that tough to do it with perl, though.

I don't think so. I did this:
Start up Terminal, and in the new Terminal window, give the command

tail -f /var/log/secure.log | grep sudo

Then in another window, use sudo, as in

sudo ls /var

Then when you give your password, watch the line from secure.log display in the other window.

Message was edited by: Don MacQueen1

Have you done any diagnostics?

For example, what happens if you do

tail -f console.log

without the pipe to grep? What happens if you do

grep "some string" console.log

without the tail? If either of those commands does not produce output, then figure out how to get it to give output before worrying about doing them in combination.

I have tested, for example,

tail -f /var/log/ipfw.log | grep Stealth

and I do get output every so often.

Do you get output if you don't put it in the background? Is their an interaction between the redirection and the backgrounding?

I don't get what's going on either, and why the original command doesn't write to a file (even though matches appear in the terminal without the redirection), but how about something like:

<pre>tail -f /path/to/console.log | while read i; do echo $i | grep "some string" >> out.txt; done</pre>

Interesting, Don. That works precisely as you describe, but if you try to send the output to a file, the output gets lost somewhere. I still think that's buffer land, though pipes don't seem to still be buffered as I remember.

mac:~ $ tty
/dev/ttyp1
mac:~ wmp$ tail -f /var/log/secure.log | grep sudo
Sep 15 08:50:41 mac com.apple.SecurityServer: ...
... four more lines of the same ...
... and subsequent lines are displayed immediately. But ...
^C
mac:~ $ tail -f /var/log/secure.log | grep sudo >sulog

... leave that running, switch windows ...
mac:~ $ tty
/dev/ttyp2
mac:~ $ cat sulog
mac:~ $ sudo ls > /dev/null
Password:
mac:~ wmp$ cat sulog
mac:~ wmp$

... switch windows, kill tail -f, switch back ...
mac:~ $ cat sulog
mac:~ $

So where's the output? I'm sticking with lost in buffer land.

It's because stdout is buffered. Your confusion didn't seem to affect your ability to come up with an elegant solution, though.

mac:~ $ log=/var/log/secure.log
mac:~ $ tail -f $log | while read i; do echo $i | grep /bin/su >> log; done &
[3] 2127
mac:~ $ wc log
10 171 1594 log
mac:~ $ su
Password:
su: Sorry
mac:~ $ wc log
11 189 1748 log
mac:~ $

This may very well be portable these days, but I don't think it's backward compatible to ancient versions of Unix. Depends on precisely how the shell implements pipes. If they're buffered in the same way output redirection is buffered, this won't work.

Message was edited by: B3and88