What is difference between tail -f and tailf in unix?

Question

I try to show tail of a text file. If file is small, there is no difference. However if file is too big (~5 gB), tailf does not respond. On the other hand tail -f works fine. What is difference between them?

Answer 1

I have faced the same issue. The log file was about 47GB. The tailf just waits almost infinite. But the tail -f begin to print the output within seconds.

I have digged deeper by examining the underlying system calls using strace command. The results given below:

# strace tailf /var/log/messages

(truncated)
stat("/var/log/messages", {st_mode=S_IFREG|0600, st_size=47432599401, ...}) = 0
open("/var/log/messages", O_RDONLY)     = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=47432600425, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7dba2d1000
read(3, "Nov  1 03:23:01 hostnameXXXX"..., 4096) = 4096
read(3, "0.31.148.12)\nNov  1 03:54:33 del"..., 4096) = 4096
read(3, "io.c(600) [receiver=3.0.6]\nNov  "..., 4096) = 4096
(truncated)

As you can see, the tailf is trying to read (buffer) all the lines from beginning before generating output to the screen.

Check the output of tail -f below, here it is using the system call lseek (C/C++) to directly jump to end of file and start reading from there:

# strace tail -f /var/log/messages

(truncated)
open("/var/log/messages", O_RDONLY)     = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=47294167448, ...}) = 0
lseek(3, 0, SEEK_CUR)                   = 0
lseek(3, 0, SEEK_END)                   = 47294170917
lseek(3, 47294169088, SEEK_SET)         = 47294169088
(truncated)