Syslog MultiTail

MultiTail lets you view one or multiple files like the original tail program. The difference is that it creates multiple windows on your console (with ncurses). It can also monitor wildcards: if another file matching the wildcard has a more recent modification date, it will automatically switch to that file. That way you can, for example, monitor a complete directory of files. Merging of 2 or even more logfiles is possible. It can also use colors while displaying the logfiles (through regular expressions), for faster recognition of what is important and what not. It can also filter lines (again with regular expressions). It has interactive menus for editing given regular expressions and deleting and adding windows. One can also have windows with the output of shell scripts and other software. When viewing the output of external software, MultiTail can mimic the functionality of tools like 'watch' and such.
For a complete list of features

• Display logfiles
  • More than one in multiple windows
    • Terminal window is not only horizontally divided, also vertical is possible
      • Height/width of the windows can be set
      • Number of windows per column can be configured
    • Windows can be swapped and closed
    • A window can temporarily be hidden
      • all windows can be unhidden at once
      • all windows but the one selected can be hidden at once
    • New windows can be created
      • The fileselector has "TAB-completion"
    • Windows can be temporarily hidden
    • all windows can be merged into one new popup window
  • Multiple logfiles can be merged into one window
  • One can search in all windows at once
    • All found lines can be merged into one new popup-window
    • or displayed reversed (highlighted) in their original window
  • Logfiles can be filtered with the help of one or more regular expressions
    • Certain lines can be suppressed -or- everything is supressed instead of what matches with the regular expressions
      • parts of strings can be selected (like sed substring selections)
      • parts of strings can be removed (using either column selection and range selection)
    • Control characters can be displayed in caret notation
    • An external tool can be executed when a regular expression matches
    • Parts of the line can be highlighted
    • The screen can flash or a beep can be heard when a regular expression matches
    • Certain parts of the logfiles can be highlighted via colors.
      • Selections with regular expressions.
      • Selection on field-number/string offset
      • Color schemes can be defined in a configurationfile. A couple of examples have been included (Postfix, Apache, RSStail, Acctail, WTMPtail, Squid, Asterisk, Sendmail, Mailscanner, Samba, Exim, HTTPing, TCPdump, ISC-DHCPD, Bind, Smartmontools, Kerberos, NTPd, nagtail, WebSphere (SystemErr), NNTPcache, Veritas Netbackup procmail, Checkpoint Firewall-1, Netscape directory server (LDAP), log4j, ClamAV, p0f, sysstat, portsentry, pppd, strace, Linux firewall (netfilter) logging, Argus, Snort, Motion, IBM AIX errpt, MySQL error log, BOINC, acpitail, netstat) - easily extensible.
      • Default color scheme for certain files can be selected in the configurationfile (using regular expressions (NOT wildcards!))
      • External scripts(!) can be used to determine what colors to use where in the logged lines
      • Use of colors can be switched off
    • One specific color can be set for one file/command: usefull when merging multiple inputs in one window
    • When setting colors, one can select a foreground and a background as well as an attribute (bold, underline, etc.)
    • a set of reg-exp filters can be defined in the configfile
    • priority of regular expressions can be set
  • A label can be put in front of lines depending on the subwindow (usefull when merging)
  • Parts of lines can be filtered
    • Using ranges
    • Using column-numbers
    • Using regular expressions
  • MultiTail can act as a "visual pipe" (or 'multi-tee'). While displaying inputs, the following is possible:
    • The input can be written to one or more files, either filtered or unfiltered
    • The input can be send (piped) to one or more processes, either filtered or unfiltered
    • The input can be send (piped) to a syslog server, either filtered or unfiltered
  • MultiTail can act like a syslog server
  • When it is detected that a line gets repeated, it can be replaced with a "Last message repeated x times" message
  • A mark-line can be added automatically when it is detected a logfile/process has been idle for a configurable amount of time
  • When a file has changed, the statusline (each logfilewindow has a statusline) is updated to show the new size and the timestamp of the change ('atime')
    • Statusline can be switched off
    • Statusline can be put above or below data window
    • Colors/attributes of statusline can be set
    • A message can be shown when the current user has new mail
    • Instead of the filename/commandline a more descriptive text can be put in the statusline
    • Filesizes can be abbreviated to KB/MB/GB
    • A statusline in the xterm titlebar can be shown:
      • Current user
      • Current hostname
      • Name of changed file
      • Timestamp of change
      • System load
      • "new mail" indicator
  • The initial number of lines read can be set
  • Instead of the descriptor also the filename can be followed (usefull for situations where "mv log log.old" is done after which a new file 'log' is created)
  • It can also monitor wildcards: if another file matching the wildcard has a more recent modification date, it will automatically switch to that file. That way you can, for example, monitor a complete directory of files.
• Of course, STDIN can be monitored as well.
• You can truncate a logfile from within MultiTail
• Idle windows can automatically be closed.
• Window can be left open when the process underneath exits
• Windows can be restarted
• Not only logfiles, also external programs can be viewed (e.g. the output of netstat)
  • Programs can be automatically restarted (like the 'watch' program)
    • Restart interval can be set
    • The difference since the previous run can be displayed (instead of everything)
    • The last exit status of command is displayed in the statusline
    • a window can be cleared before a new iteration (-rc)
  • One can now send signals to running commands
  • Output can be merged with the output of other programs
  • Output can be merged with logfiles
  • Output can be colored: see 'logfiles'-section
  • Output can be filtered: see 'logfiles'-section
  • A statusbar can be shown: see 'logfiles'-section
  • One can type in the window of a program, like the 'splitvt' program
  • Line wrap is configurable
    • Cut off at the left or right
    • Wrap at the right
    • Cut off at the syslog procname
• One can scrollback in a window
  • All text (including that of the scrollbackbuffer) can be stored in a file
  • Size of scrollbackbuffer can be set (in number of lines and KB)
  • A searchfunction is included (also with regular expressions!)
  • Line wrapping can be switched off, after that one can scroll to the left/right with the cursor keys
  • Scrollback window has the same keybindings of 'less'
  • All scrollback windows can be cleared in one go (press 'N')
• One can set marks
  • A mark (a line) can be set so that one can easily see what is new
    • The attributes (foreground, background, underline, bold, etc.) can be set for the markerline
    • A timestamp can be printed in the markerline
  • A window can be cleared while maintaining the scrollbackbuffer
  • MultiTail can automatically add a marker when it switches subwindow
  • syslog '-- MARK --' lines can be replaced
  • when a window is idle for a configurable amount of time, a markerline can be displayed
• The width of a tab can be set
• For lines longer then the width of a window, one can set what to be shown:
  • The complete line
  • Only the left part
  • Only the right part
  • A configurable offset
  • In case of a 'syslog'-style logfile;
    • Everything after the date/time
    • Everything after the date/time without the procname
• Update frequency of the display can be set (default: immediately), usefull for slow links
• Some statistics can be shown (update frequency, tendency of the update frequency)
• Bind external programs to keys. For example: one can let MultiTail execute /usr/bin/pine when CTRL+G is pressed. That way MultiTail can act as a central command center.
• In case one is monitoring something without timestamps, multitail can add them itself
• The format of timestamps can be configured in the configurationfile
• While displaying, MultiTail can convert parts of the input:
  • ip-adresses to hostnames
  • an external script can be invoked for the conversion
  • seconds since the UNIX epoch to user configurable timeformats
  • "errno" values to descriptive messages
  • decimal to hex and hex to decimal
  • tai64 (qmail etc.) to user configurable timeformats
  • a value to KB/MB/GB
  • signal number to signal name
• Has context-sensitive on-line help (press F1 at any time)
• Instead of a beep, one can get a beep, a flashing screen, nothing or a popup
• all configurationfile settings can be set from the commandline
• suppressing of empty lines can be configured in the configfile
• one can let multitail beep for every x-th line it processes
• inputfields have a history buffer which is automatically stored on disk
• other tail variants can be used (e.g. inotail)

MultiTail is included in the SuSE CDs/DVDs up to version 10.0.  For Solaris up to date binaries can be retrieved from sunfreeware.com.

MultiTail lets you view one or multiple files like the original tail program. The difference is that it creates multiple windows on your console (with ncurses). It can also monitor wildcards: if another file matching the wildcard has a more recent modification date, it will automatically switch to that file. That way you can, for example, monitor a complete directory of files. Merging of 2 or even more logfiles is possible.

It can also use colors while displaying the logfiles (through regular expressions), for faster recognition of what is important and what not.

It can also filter lines (again with regular expressions). It has interactive menus for editing given regular expressions and deleting and adding windows. One can also have windows with the output of shell scripts and other software.

When viewing the output of external software, MultiTail can mimic the functionality of tools like 'watch' and such.

For a complete list of features, look here.

Old News ;-)

[Dec 1, 2006] Net::Dev::Tools::Syslog  version 0.8.0

Net::Dev::Tools::Syslog  version 0.8.0
=======================================

DESCRIPTION

This module provides functionality to:
   - parse syslog log files, apply filters
   - send syslog message to syslog server
   - listen for syslog messages on localhost
     - forward received messages to other syslog server


INSTALLATION

To install this module type the following:

   perl Makefile.PL
   make
   make test
   make install

DEPENDENCIES

This module requires these other modules and libraries:

   Time::Local
   IO::Socket
   Sys::Hostname

Recommended Links

Softpanorama Recommended

Internal

• Log analyzers
• Log Colorizing
• Log rotation

External

• Loganalysys/Generic Log Parsing Tools
• LMF by perldork
• devialog
• kazimir
• Octopussy

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: January 23, 2010