forked from mbucc/retail
-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathretail.1
138 lines (138 loc) · 3.33 KB
/
retail.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
.\"
.\" Copyright (c) 2014 Mark Bucciarelli <mkbucc@gmail.com>
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.\"
.\"
.Dd $Mdocdate: December 27, 2014 $
.Dt RETAIL 1
.Os
.Sh NAME
.Nm retail
.Nd display the additions to a file since previous retail run
.Sh SYNOPSIS
.Nm retail
.Op Fl o Ar datafile
.Ar file
.Sh DESCRIPTION
The
.Nm retail
utility displays the lines added to
.Ar file
since the last run
to stdout.
.Pp
After each run, the
.Nm retail
utility stores the most recent
size, byte offset and inode of
.Ar file.
By default, this information is stored
in the same directory
as
.Ar file
and with the same name as
.Ar file
except with the prefix ``offset.'
For example, if the
.Ar file
is ``syslog'',
the offset data will be stored in a file named
``offset.syslog''.
.Pp
The utility accepts one option:
.Bl -tag -width -Ds
.It Fl o Ar datafile
The
.Ar datafile
option lets you specify where to store the
data from the last run.
If the option specifies a file,
the data is stored in that file.
If a directory,
the data is stored
in that directory,
using the default file name
described above.
.El
.Pp
In some cases,
.Nm retail
will notice that the file has been rotated
and tail the rotated file before
tailing the current file.
.Pp
Specifically,
if the inode of the file is unchanged
and the file is smaller,
.Nm retail
assumes the file
was rotated via a copy and truncate.
The utility
looks for files
(in the same directory)
that match the file name
and takes
the most recently modified one.
For example,
if the file name is ``syslog'',
and the same directory
has the files ``syslog.1'' and ``syslog.2'',
.Nm retail
will assume the most recently modified
of the two is the rotated file.
.Pp
If the inode is different,
.Nm retail
assumes the file
was rotated via a move and recreate,
and
looks for a file with the old inode.
If it can't find one,
.Nm retail
assumes the old file was gzipped
after the move
and
looks for the most recently changed file
in the same directory
with a name that
starts with the file name
and ends with ``.gz''.
.Pp
If neither of these conditions apply,
then
.Nm retail
does not try to find a rotated file.
.RE
.Sh EXIT STATUS
The
.Nm retail
utility returns 0 on success
and 1 if an error occurs.
.Sh EXAMPLES
To retail syslog and store the offset data in ``/var/db/retail/offset.syslog''.
.Pp
.Dl $ retail -o /var/db/retail/ /var/log/syslog
.Sh SEE ALSO
.Xr tail 1 ,
.Xr http://sourceforge.net/projects/logtail-v3/ ,
.Xr http://ranum.com/security/computer_security/code/index.html
.Sh HISTORY
.Pp
Initially published by Craig H. Rowland in 1996.
He got the idea from
the retail utility,
which came with
Trusted Information Systems'
Gauntlet(TM) firewall protection package.