Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How can I view log files in Linux and apply custom filters while viewing?

I need to read through some gigantic log files on a Linux system. There's a lot of clutter in the logs. At the moment I'm doing something like this:

cat logfile.txt | grep -v "IgnoreThis\|IgnoreThat" | less 

But it's cumbersome -- every time I want to add another filter, I need to quit less and edit the command line. Some of the filters are relatively complicated and may be multi-line.

I'd like some way to apply filters as I am reading through the log, and a way to save these filters somewhere.

Is there a tool that can do this for me? I can't install new software so hopefully it's something that would already be installed -- e.g., less, vi, something in a Python or Perl lib, etc.

Changing the code that generates the log to generate less is not an option.

like image 242
Dan Avatar asked Feb 26 '10 00:02

Dan


People also ask

What are filters used for in the logs view?

Filters allow you to select data based on values that it contains. Most frequently, you use filters when viewing logs, but filters can also be used for other tasks, such as exporting logs and selecting data for reports. Diagrams allow you to visualize your network security environment.

How do I view a specific log in Linux?

This is such a crucial folder on your Linux systems. Open up a terminal window and issue the command cd /var/log. Now issue the command ls and you will see the logs housed within this directory (Figure 1).

How do I analyze a log file in Linux?

One of the simplest ways to analyze logs is by performing plain text searches using grep. grep is a command line tool that can search for matching text in a file, or in output from other commands. It's included by default in most Linux distributions and is also available for Windows and Mac.


1 Answers

Use &pattern command within less.

From the man page for less

&pattern

          Display  only  lines which match the pattern; lines which do not           match the pattern are not displayed.  If pattern  is  empty  (if           you  type  &  immediately  followed  by ENTER), any filtering is           turned off, and all lines are displayed.  While filtering is  in           effect,  an  ampersand  is  displayed  at  the  beginning of the           prompt, as a reminder that some lines in the file may be hidden.            Certain characters are special as in the / command:            ^N or !                  Display only lines which do NOT match the pattern.            ^R     Don't interpret regular expression  metacharacters;  that                  is, do a simple textual comparison. 
like image 116
ALF Avatar answered Sep 23 '22 00:09

ALF