Quote:
Originally Posted by
jim mcnamara
Some considerations.
Most modern kernels maintain a memory cache of pages written to files. The dirty (changed or added data) pages get written to disk physically - when the system does a fflush (or equivalent) call. Which is not always RIGHT NOW. Also file mtime and atime updates may be deferred until the file descriptor is actually closed. All of this is kernel-dependent and depends what kind of file system is in use (plus mount options).
Depending on the application writing the log file there can also be stdio buffers inside the program that delay data written by functions like
printf() being given to the kernel (by a
write() or similar system call).
On POSIX- and UNIX-conforming filesystems, the timestamp updates can be delayed until all file descriptors for a given file in processes system-wide are closed, or any application (such as
ls -l) performs a
stat() (or similar) system call to get the status of that file, whichever comes first. Of course, some systems provide mount options to delay timestamp updates as a performance enhancing "feature" (even though this "feature" can break applications such as the one being discussed in this thread). But, this only applies to timestamps marked for update in the kernel; timestamps are not marked for update by functions like
printf(), unless the underlying stdio buffer is flushed to the kernel.
