Logtail Patch

This patch for logtail makes the program check files called $logfile.0 to see if they were the last files examined, and if so, display changes in those files too. Normally, logtail disregards any changes that may have been made between the last invocation and rotation.

Some systems may rotate to $logfile.1 rather than $logfile.0, but mine doesn't.

This is for an ancient version of logtail, and may no longer apply.

 --- /usr/sbin/logtail   2004-09-23 06:06:24.000000000 +0930
 +++ logtailng.pl        2004-11-11 02:10:55.000000000 +1030
  -21,7 +21,7 

  use strict;
  use warnings;
 -my ($size);
 +my ($size, $rotsize);
  use Getopt::Std;
  my %opts = ();

  -52,7 +52,7 
      exit 66;
  }

 -my ($inode, $ino, $offset) = (0, 0, 0);
 +my ($inode, $ino, $offset, $rotatedino) = (0, 0, 0, 0);

  unless (not $offsetfile) {
      if (open(OFFSET, $offsetfile)) {
  -82,6 +82,22 
              print "*************** This could indicate tampering.\n";
          }
      }
 +
 +    # Check for the existence of a rotated log
 +
 +    if ((undef,$rotatedino,undef,undef,undef,undef,undef,$rotsize) = stat
 "$logfile.0") {
 +        if ($inode == $rotatedino && $offset < $rotsize) {
 +            unless (open(LOGFILEROT, "$logfile.0")) {
 +               print "File $logfile.0 cannot be read.\n";
 +               exit 66;
 +            }
 +            seek(LOGFILEROT, $offset, 0);
 +            while (<LOGFILEROT>) {
 +                print $_;
 +            }
 +            close LOGFILEROT;
 +        }
 +    }
      if ($inode = $ino || $offset > $size) {
          $offset = 0;
      }