Let's say I have a file called data.log.
Data constantly gets appended to it which can contain 'flag' and it gets truncated by an external script:
[13/Jan/2015:11:11:53 +0000] curabitur flag lacinia nibh in feugiat mollis
tail: data.log: file truncated
[13/Jan/2015:11:11:53 +0000] dapibus enim sagittis efficitur
[13/Jan/2015:11:11:54 +0000] iaculis non flag ac urna.
After declaring counter=0, I want to increment it with the amount of found occurrences. I came up with something like this, which uses wc -l to count the lines in data.log containing 'flag':
counter=$(($counter+$(cat data.log | grep s | wc -l)))
echo $counter
Now there's only one problem left: the truncating. How would I approach this? I thought of doing a watch, but how do I pick up on the truncating event? Or is there another direction I should be heading altogether?
This should work for you:
$ tail -F data.log | grep --line-buffered s | while read match ; do ((counter++)) ; done
The -F flag for tail is the same as --follow --retry. --retry is the magic bit here:
--retry
keep trying to open a file even when it is or becomes inaccessi‐
ble; useful when following by name, i.e., with --follow=name
I also used --line-buffered with grep, to avoid the while loop needing to wait for output.
One problem with this that I've just realised: if flag appears more than once for every line, $counter will still only be incremented by 1. But that issue is in your solution as well.