how to read / copy a tmp file which exists for a very short time

Question

my nginx creates tmp files for requests which are bigger than 16kb. I am trying to read this tmp files but they only exist for a rly short period of time (1ms?). Is there unix command / programm which can help me to read this files before they are gone?

the ngnix warning message looks like

a client request body is buffered to a temporary file /var/lib/nginx/body/0000001851

EDIT i am not in the position to alter the ngnix source code nor am i able to edit the source code of the request origin. I just want to take a look at this files for debugging purpose as i cant imagine what kind of request will bloat up to 16k

Answer 1

In general you'll probably want to get nginx's assistance for this or if that's not possible and it's really important change the source code as Leo suggests.

---

There is one cringe-inducing, wtf-provoking trick which I am mentioning as a curiosity. You can set the append-only mode on the directory. If your filesystem supports it you can say:

chattr +a mydir

Your process will be able to create stuff inside but not remove it. Then at your leisure you can use inotify_wait to monitor the directory for changes. I don't know of any clean ways to remove the files though.

Answer 2

Well you could try parsing the output with something like:

stdbuf -oL nginx 2>&1 |
  grep -F --line-buffered \
    "a client request body is buffered to a temporary file" | {
      while read -a line
      cp line[${#line[@]}-1] /dest/path
    }

Although you might find that this is too slow and the file is gone before you can copy it.

A better solution might be to use inotify. inotify_wait as mentioned by cnicutar would work. You could try the following:

while true
do
  file=$(inotifywait -e create --format %f -r /var/lib/nginx/body/)
  cp "/var/lib/nginx/body/$file" "/dest/path/$file"
done

If you don't get what you are looking for (eg if the files are copied before all the data is written), you could experiment with different events instead of create, maybe close, close_write or modify.