Question

I am trying to build a small demon in PHP that analyzes the logfiles on a linux system. (eg. follow the syslog).

I have managed to open the file via fopen and continuosly read it with stream_get_line. My problem starts when the monitored file is deleted and recreated (eg when rotating logs). The program then does not read anything anymore, even if the file grew larger than previously.

Is there an elegant solution for this? stream_get_meta_data does not help and using tail -f on the command line shows the same problem.

EDIT, added sample code
I tried to boil down the code to a minimum to illustrate what I am looking for

<?php
$break=FALSE;
$handle = fopen('./testlog.txt', 'r');
do {
    $line = stream_get_line($handle, 100, "\n");
    if(!empty($line)) {
        // do something
        echo $line;
    }
    while (feof($handle)) {
      sleep (5);
      $line = stream_get_line($handle, 100, "\n");
      if(!empty($line)) {
        // do something
        echo $line;
      }
      // a commented on php.net indicated it is possible
      // with tcp streams to distinguish empty and lost
      // does NOT work here  --> need somefunction($handle)
      if($line !== FALSE && $line ='') $break=TRUE;
    }
} while (!$break);
fclose($handle);
?>

Answer 1

When log files are rotated, the original file is copied, then deleted, and a new file with the same name is created. It may have the same name as the original file, but it has a different inode. Inodes (dumbed down description follows) are like hidden incremental index numbers for your files. You can change the name of a file, or move it, but it takes the inode with it. Once that original log file is deleted, you can’t re-open a file with the same name using the same file handler, because the inode has changed. Your best bet is detect the failure, and attempt to open the new file.