Tracking a file in real-time

[Les Mikesell]

Tony Nelson wrote:
B.
>>
>> I thought about tail -f, but that only lists the entries being added.
>> Doing diff would require copying the file and running diff against it
>> every second or so, and then again it wouldn't necessarily list all the
>> changes, just the one between the last changed file and the current one.
> 
> Copy the file, compare the copy against the previous copy.  Note that the
> file may have changed during the copy, so the copy may contain partial
> changes.
> 
> 
>> I hope I'm explaining this clearly, but basically the question is, is
>> there a utility in Linux/Unix world which can track any changes being made
>> to a file in real-time and list/track/put-in-a-file those changes being
>> made?
>>
>> Many thanks for any help you can provide.
> 
> Perhaps inotify can resolve the OP's objection to "running diff against it
> every second or so", but it is an optimization to apply after the problem
> is solved.

Stat()'s are pretty cheap, so checking if the modification time has 
changed every second might be reasonable and only doing the

> 
> Probably diff'ing is not the correct approach at all, and it would be
> helpful to know what is writing that file, and whether it can be persuaded
> to write a log file.

As a fairly horrible hack you could strace the process and track the 
lseeks and writes, or use the -e write= to get a copy of the writes to 
the specified file descriptor.

-- 
   Les Mikesell
    lesmikesell at gmail.com