[HN Gopher] Use the 'tail' command to monitor everything
___________________________________________________________________
Use the 'tail' command to monitor everything
Author : belter
Score : 32 points
Date : 2021-07-12 19:07 UTC (3 hours ago)
(HTM) web link (blog.robertelder.org)
(TXT) w3m dump (blog.robertelder.org)
| 1vuio0pswjnm7 wrote:
| I never type the letter n as in "-n 5" when using tail or head. I
| just replace n with the number, e.g., "-5". Its a habit I never
| broke because I still haven't encountered a situation where it
| does not work.
| hirundo wrote:
| Does anyone know an easy way to tail follow two logs at once on a
| pair of load balancing servers?
| gorgoiler wrote:
| You can _ssh host1 tail -F log | sed -e s /^/host1:/_
|
| But you might eventually want to log everything to a third
| host. Use syslog to send logs across the network and configure
| your local software to log to syslog.
|
| When you have 10k hosts then sampling 1 in N log lines is still
| useful as a canary, while avoiding being a firehouse for the
| central log sampler. If something heinous occurs you can get
| the unsampled log from the original machine, if you need it.
|
| Much more sophisticated techniques abound, and others will
| comment I'm sure, but it's also nice to have the syslog trail
| as a fallback. You never know in advance what's going to fail
| and syslog will show you everything from your Apache logs to
| kernel bugs and faulty NICs.
| jolmg wrote:
| > You can ssh host1 tail -F log | sed -e s/^/host1:/
|
| That's only for one host. If you mean something akin to:
| tail -F <(ssh ...) <(ssh ...)
|
| that wouldn't work, because `tail` would wait for the first
| `ssh/sed` to close their output (to reach the end of the
| first pipe) before starting to read the second `ssh/sed`'s
| output.
| [deleted]
| [deleted]
| retzkek wrote:
| Honestly Loki and Promtail are so easy to setup, and jump into
| not just tailing and searching but incorporating logs into
| Grafana dashboards (you are using Grafana already to monitor
| host and service metrics, right?), that they make sense to run
| for everything but the smallest scale deployment (that is, a
| single service on a single node).
| jolmg wrote:
| mkdir foo bar sshfs foo.server:foo.dir/ foo/ sshfs
| bar.server:bar.dir/ bar/ tail -F foo/foo.log bar/bar.log
| tstack wrote:
| Sorry to plug lnav again, but if the data volume is not "too
| much"[1], the latest version of lnav has support for tailing
| files on remote hosts that are accessible via ssh:
|
| https://lnav.org/2021/05/03/tailing-remote-files.html
|
| So, to tail "/path/to/log" on host1 and host2, you'd start lnav
| with: $ lnav host1:/path/to/log
| host2:/path/to/log
|
| [1] - This is the initial release of this feature, so it
| probably has some performance issues. I'd be interested to know
| if it worked or not.
| hoytech wrote:
| Not sure how standard it is, but at least on linux you can do
| "head -3" as a short-cut for "head -n 3". Same with tail.
| dcsommer wrote:
| I recommend using `less <FILE>` <shift-F> rather than plain `tail
| -f <FILE>` because you can ctrl-c to stop the tailing and then
| search the text using /. You can then resume tailing again later
| with another <shift-F>.
| ithkuil wrote:
| And you can also use the & command to filter (out) some
| patterns, while you're tailing.
| anyfoo wrote:
| I love to press enter a few times to add a few empty lines to
| serve as a marker. Plus, I set my terminal scrollback buffer to
| 10000 lines (not a problem nowadays), so cmd-F in the terminal
| works pretty well. _And_ I prefer the natural /kinetic
| scrolling of the terminal backlog to less as a fullscreen tty
| program.
|
| Finally, as the article alludes to, tail can monitor multiple
| files at once.
| ryanmonroe wrote:
| Or hit v after Ctrl-C to open it in a full editor (vi or
| whatever editor you have as $VISUAL). Quitting the editor
| resumes tailing.
| iamthad wrote:
| Equivalently, one can run `less +F <FILE>`
| rzzzt wrote:
| tailf is also a good replacement for tail --follow=name, it
| uses inotify internally to only look at the file when there is
| a change.
| lightlyused wrote:
| On tail don't forget to use -F to tail a fail that gets rotated.
| tstack wrote:
| If you're tailing logs, can I suggest that you try out the
| Logfile Navigator (https://lnav.org). It really is possible to do
| better than tail/less/whatever when you just want to look at a
| local log file:
|
| https://lnav.org/2013/09/10/competing-with-tail.html
| DubiousPusher wrote:
| 'tail' is so neat and versatile.
|
| I used it as a solution to allow me to trigger backups of
| minecraft worlds from within the game. Anything you put to the
| 'say' command is written to the game's log. I use
|
| tail -F -n 0 ./logs/latest.log | grep --line-buffer <command-
| pattern> | sudo xargs -L1 ./some_script.bsh
|
| to detect commands in the log and shuttle them to a custom
| script. In my case it zips a copy of the world and pushes it to
| blob storage.
|
| I'm not a unix guy so figuring this all out was quite gratifying.
___________________________________________________________________
(page generated 2021-07-12 23:00 UTC)