Three commands to view logs in Linux

The three commands for viewing logs in Linux are: 1. tail command, which can view changes in file content and log files in real time; 2. multitail command, which can monitor multiple log files at the same time; 3. , less command, which can quickly view log changes without cluttering the screen.

#The operating environment of this tutorial: linux5.9.8 system, Dell G3 computer.

What are the three commands to view logs in Linux?

3 ways to view logs in real time in Linux

I recently purchased a cloud server from cnaaa.com.

We all should know how to view files in Linux, for example, you can use the cat or less command.

This is fine for viewing static files. Log files are dynamic and their contents can change at any time. To monitor log files, you need to be able to see in real time when the contents of the log files change.

So how to view the log file in real time? The tail command is available. In addition, there are other tools. This article will introduce these tools that can view log files in real time.

1. Use the tail command to view the log file

The tail command is very widely used, so system administrators often use the mantra tail the log file (ie: tail the log file) .

In most cases, the tail command is used to view the content at the end of the file, so it is named tail.

Use the -f option to track the content at the end of the file, which means it will continue to display newly added content to the file.

tail -f location_of_log_file

[The external link image transfer failed. The source site may have an anti-leeching mechanism. It is recommended to save the image and upload it directly (img-nzCWCjye-1664183028850) (D:/img/640.png)]

To stop tracking the log file, you can use the ctrl c shortcut key.

tail and grep

As mentioned above, the tail command can view changes in file content in real time. However, when the file content is updated very quickly, the newly updated content flashes by. In this case, it is not so convenient to view.

For example, when we track log files, we often monitor a specific term (string), which is very inconvenient to track in a large amount of rapidly updated content.

To solve this problem, we can combine the tail and grep commands. As shown below:

tail -f log_file | grep search_term

[The external link image transfer failed. The source site may have an anti-leeching mechanism. It is recommended to save the image and upload it directly (img-LxXIylsU-1664183028854)(D:/img/640-1664179747239 -1.png)]

It looks much better this way, right? On this basis, let us make some improvements.

Use grep to display search terms. The information displayed is relatively limited. It only displays the search results, so we often use the -C option to display the first and last few lines of the search results:

tail -f log_file | grep -C 3 search_term

In this way, we You can see several lines of information before and after the search results, and you can better track the log information.

Do you want to make some improvements? You can use grep for multiple search terms, and then case-insensitively:

tail -f log_file | grep -C 3 -i - E 'search_term_1|search_term_2'

Use log rotation (log rotation) to track logs

Most enterprise servers, logs will be rotated (rotation), that is When the log file reaches a certain size, it is renamed and compressed.

[The external link image transfer failed. The source site may have an anti-leeching mechanism. It is recommended to save the image and upload it directly (img-h2RUcofL-1664183028856) (D:/img/640-1664179747241-2.png) ]

This can cause problems if log files are tracked in real time. By default, the tail command works on file descriptors. If the current log file is rotated, the tail command will now point to an archived log file, which will now log no changes.

The solution is to track the log file by its name. This way, even if log rotation occurs, the tail will point to the current log file (since its name never changes).

tail --follow=name log_file | grep -C 3 -i - E 'search_term_1|search_term_2'

tail is very suitable for real-time monitoring of log files, but the above method only monitors one log file. What if you want to monitor multiple log files? Please see the next section.

Use tail to view multiple log files

Working in a Linux system, you can use the tail command to monitor multiple log files at the same time. You only need to provide the path of the file:

tail -f log_file_1 -f log_file_2

With the above command, you will see the update of the log file in real time, and the file name will be in front to distinguish different log files:

[External link image transfer failed, the source site may have anti-leeching mechanism, it is recommended to save the image and upload it directly (img-CMiWKszs-1664183028859)(D:/img/640-1664179747242-3.png)]

In addition to the above method, there is another more convenient way , just use a tool called multitail.

2. Use multitail to monitor multiple log files at the same time

As the name suggests, multitail is used to display multiple files at the same time.

Since tail can monitor multiple files at the same time, what is so special about multitail?

The beauty of multitail is that it can display files in split view and even display different files in different rows and columns.

tail 在同一视图中显示所有内容，所以有时候很难跟踪，multitail 通过提供类似 screen 命令的分割视图来克服了这一困难。

注意，multitail 在大多数Linux系统中没有被默认安装，所以在使用前需要先手动安装。

在 multitail 命令后跟文件路径，最好一次不要超过3个，因为超过3个或以上，跟踪起来就比较困难了。

multitail log_file_1 log_file_2

默认情况下，multitail 的工作方式与 tail -f 相同，它显示最后100行，然后进入实时监视视图；另外，它按行来拆分视图。

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-EZ9iX4d3-1664183028861)(D:/img/640-1664179747242-4.png)]

你可以按 b 键打开一个文件选择窗口，选择某个日志文件查看，以做进一步分析。

分割视图使用 -s 选项，后面跟一个数字，即视图的数量：

multitail -s 2 log_file_1 log_file_2

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-ETQjV0KA-1664183028863)(D:/img/640-1664179747243-5.png)]

按 q 键可退出 multitail 所有的视图。

multitail 可以做的还有很多，大家感兴趣可以查看一下它的官方文档，本文就不继续介绍了。

3. 使用 less 命令实时查看日志文件

less 命令多用于读取文本文件，也可用于读取实时被更改的文件。

选项 +F 可以实时跟踪文件的更改：

less +F log_file

上述命令会打开日志文件，并实时显示正在写入的更改：

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-oDZivgss-1664183028865)(D:/img/640-1664179747243-6.png)]

按 ctrl +c 中断显示，按 q 会退出视图。

与 tail 命令不同，此方法可以让我们快速查看日志的更改，而不会使屏幕混乱。

上述监视日志的方法适用于传统的基于文本的日志文件。对于系统日志，可以使用 syslogs，但是现在许多 Linux 发行版已经开始使用 journal 日志来查看和分析日志，所以需要使用 journalctl 命令。

推荐学习：《Linux视频教程》

The above is the detailed content of Three commands to view logs in Linux. For more information, please follow other related articles on the PHP Chinese website!