Hello, Thank you for your advice! After I ran this tool and again read tail sources and `man kqueue` more carefully I hope I now have a better understanding how it is done it tail. While all the files opened with tail are in place kqueue is called with zero timeout which makes it just wait for chosen events forever. When one of the files being watched is deleted or renamed kqueue is repeatedly called with a 1 second timeout which will obviously return every time with 0 after which it is checked if the file which previously disappeared is back. If the file is back the timeout for kqueue is again set to zero, old file stats are replaced with new ones and normal data watching is resumed.
On Fri Feb 17 15:17:17 2023, Stuart Henderson wrote: > On 2023-02-17, Maksim Rodin <a23s4a2...@yandex.ru> wrote: > >> > I was able to reproduce watching for new data and truncation of the > >> > file using "kqueue" but I do not quite understand how the original tail > >> > watches when the file appears again after deletion or renaming. > > I am sorry that I could not be clear enough in my words above. > > I meant I already understood a little how "kqueue" > > magic works. And I replicated some event watching logic in my learning > > task. > > I see how file truncating, deleting and renaming is watched by waiting > > NOTE_DELETE, NOTE_RENAME and NOTE_TRUNCATE events in EVFILT_VNODE > > filter. > > But I still do not see where and what event is watched for to make sure the > > file with initial file name is back (e.g. after deletion). After deleting a > > file there is no initial file > > descriptor, so there is nothing to watch using the old EVFILT_VNODE > > filter. > > I also see that after NOTE_DELETE | NOTE_RENAME events are caught only > > tfreopen function > > is called and I do not see any event watching actions in that function. > > It will probably be easier to grok if you see for yourself rather > than have it explained. > > I suggest running tail under ktrace, and watch the output live e.g. > with something like "kdump -l | ts %.T". In particular note the last > parameter to kevent(). > > > So my primary question might be: how can I monitor file creation (using > > events) > > by only knowing its name? > > While events can be used as part of it, you do need a little more > than events to watch for file creation. > > -- С уважением, Родин Максим
