# \#985: 'tail -f' functionality for file reading in input framework

**URL:** <https://community.zeek.org/t/985-tail-f-functionality-for-file-reading-in-input-framework/2661>\
**Category:** Development\
**Tags:** development\
**Created:** [April 27, 2013, 7:39pm UTC](https://community.zeek.org/t/985-tail-f-functionality-for-file-reading-in-input-framework/2661 "2013-04-27T19:39:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Scott\_Campbell](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Scott\_Campbell](https://community.zeek.org/u/Scott_Campbell)\
**Post date:** [April 27, 2013, 7:39pm UTC](https://community.zeek.org/t/985-tail-f-functionality-for-file-reading-in-input-framework/2661/1 "2013-04-27T19:39:15Z")

</div>

> #985: 'tail -f' functionality for file reading in input framework  
> ------------------------+----------------------------- Reporter:  
> scampbell | Type: Feature Request Status: new |  
> Priority: Low Milestone: Bro2.2 | Component: Bro Version:  
> git/master | Keywords:  
> ------------------------+----------------------------- With the  
> current input framework, file data -\> event translation requires  
> that the entire data file be read at bro start time. This can be  
> prohibitive when the file sizes become large ( \> 1GB ).
> 
> It would be great to see a file open option that would start  
> reading at the end of the file.

I tried to update the ticket, but there seems to be issues with the  
bug tracker.

The patch to support this functionality is attached - it is only a few  
lines. An example of using this looks like:

> Input::add\_event([$source=data\_file, $reader=Input::READER\_RAW,  
> $mode=Input::TSTREAM, $name="issh", $fields=lineVals,  
> $ev=sshLine]);

thanks!  
scott

[PATCH](https://community.zeek.org/uploads/short-url/yR731Hv9fXTqJHq9sm9tXBOD47L) (2.58 KB)

[PATCH.sig](https://community.zeek.org/uploads/short-url/6P35gVZKYp2gTlrGBxDUuBQy3M1.sig) (65 Bytes)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/985-tail-f-functionality-for-file-reading-in-input-framework/2661/2 "2022-05-06T15:40:57Z")

</div>