2

I am currently debugging a weird problem on my server and therefore I am searching for a tool that is monitoring the standard log folder /var/log/. Any changes to the existing files should be printed so that I know what exactly happens.

As I am not just starting one program but rather making requests to different services strace is not helping. Solutions proposed here monitoring file changes + process access to files are outdated or limited to non-recursive folder structures.

matt3o
  • 123
  • 4
  • 1
    Tried `inotifywait` with `-r`? – phk Feb 12 '17 at 14:24
  • Nope not yet. Will try it soon, does it work on any folder depth? – matt3o Feb 12 '17 at 14:27
  • Okay, so thanks for the input, this is working fine for detecting any changes at all - what I'm searching for is for a tool to print the modified lines directly. – matt3o Feb 12 '17 at 14:37
  • 1
    Log files are modifying in a very specific way, only by appending lines. The tool of choice is `tail -F`, or, if you don't want to write your own multiple-tail script, [`multitail`](https://www.vanheusden.com/multitail/); check whether it's available as an installable package or else download it from the author's site. – AlexP Feb 12 '17 at 14:49
  • Cool, this pretty much what I wanted. What I now tried to is to make it use all files in the log folder, like this: `multitail -c --mergeall "$(find . -type f | grep -v gz | sed ':a;N;$!ba;s/\n/ /g')"` Sadly there is still one small error remaining (the parsing of the whitespaces) but I hope I can fix it soon. – matt3o Feb 12 '17 at 15:46

1 Answers1

3

You can use multitail to watch content that gets added to multiple files. It's like tail -f on steroids. To watch files in a directory and its subdirectories, get your shell or find to list the files.

cd /var/log
multitail -n 0 --mergeall **/*.log

In bash, run shopt -s globstar first to activate ** as a recursive directory glob. In ksh, run set -o globstar. In zsh, it's on by default.

Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
  • Did not know that about using ** - thanks! And yes, one more vote for tail -f or a variant thereof – ivanivan Feb 13 '17 at 01:00
  • That's really useful, thanks! Any chance you can help me fix the find code I posted in the comment above? It allows a more granular filtering of the log files: `multitail -c --mergeall "$(find . -type f | grep -v gz | sed ':a;N;$!ba;s/\n/ /g')"` – matt3o Feb 13 '17 at 11:47
  • @matt3o `shopt -s extglob` then `multitail … **/!(*.gz)` – Gilles 'SO- stop being evil' Feb 13 '17 at 11:53