On 16/01/2021 23:52, Martin Gregorie wrote:
> On Sat, 16 Jan 2021 23:30:34 +0000, Pancho wrote:
>
>> On 16/01/2021 22:33, Martin Gregorie wrote:
>>> On Sat, 16 Jan 2021 20:39:09 +0000, Pancho wrote:
>>>
>>>> On 16/01/2021 17:53, Martin Gregorie wrote:
>>>>
>>>>
>>>>> sudo tail -f  /var/log/messages | awk -- '{ print $0 }'
>>>>>
>>>>> which works here.
>>>>>
>>> Messages added to /var/log/messages with the following command are
>>> displayed almost instantly, though they aren't exactly readable since
>>> the text is shown as a hex string:
>>>
>>> sudo echo "Another message" 2>&1 | logsave /var/log/messages -
>>>
>>>
>> Why not just use the logger command?
>>
>> e.g.
>>
>> logger "Another message"
>>
>> You seem to be over complicating things: why redirect stderr to stdin
>> 2>&1 from echo, echo doesn't need sudo, logsave /var/log/messages does
>> need sudo, logsave is truncating /var/log/messages.
>>
>> The immediate response you are seeing is stderr from tail, which isn't
>> being piped to awk at all. This error message is generated by tail -f
>> because logsave truncates the file that is being tailed, logsave -a
>> appends.
>>
>> The manual says pipes are buffered. My experiments say pipes are
>> buffered.
>
> So how come you're getting delays and I'm not?
>

Dunno, I thought I had explained the

sudo echo "Another message" 2>&1 | logsave /var/log/messages -

Causing an error in tail -f /var/log/messages.


On further reflection (and Googling) I have discovered it was awk that
was buffering, not the pipe. Apparently when awk is in a pipeline it
stops being in "interactive" mode. This can be fixed using awk -W
interactive

For a simple example:

In one bash shell terminal:

$ tail -f  /var/log/messages | awk -- '{ print $0 }'

In another:

$ logger "Another message."

You will see nothing until you repeat the same command many times. Then
you will see it all burst out in one go. (Less repeats if you use use a
longer message.)


However, this command produces an immediate response.

$ tail -f  /var/log/messages | awk -W interactive -- '{ print $0 }'

This applies to journalctl -f, too.

So something new learnt :-) (or possibly even relearnt, for me anyway)

However, I'm not yet convinced this is a sensible way of observing
events. I'm still undecided.

--- SoupGate-Win32 v1.05