asked on

how to highlight certain words while tailing log on unix/linux

Hi,

Is there a way to highlight few words while tailing (tail -f logfile.log) log files on unix or linux.

Bascially, would like to highlight (ONLY the word or the word background color) for certain keywords ex "ERROR" or "FAILED" ...so while tailing (scrolls up) it can be easily noticed.

Right now, I have a script which scans the log file and write only the lines which I'm interested in to a different file...then I open the newly created file and so on.

thanks in advance

ASKER CERTIFIED SOLUTION

ozo

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Duncan Roe

The less command can do what you want (did you know it can act like tail -f?)
less your log file (that is being written to). After a screen of output, you get a prompt.
Enter your search criteria, e.g. /ERROR|FAILED (less search strings are regular expressions).
Eventually you get another prompt (after ERROR or FAILED is displayed, highlighted, on line 1).
At this prompt, enter F (just a capital F). less will tail the file, and you will see highlighted matches as they occur. You can enter Control-C at any time to stop tailing; at which point you can use N (capital N) to visit previous matches.
If you want the match to show some way down the page so you can see preceding context, enter -jnumber at any prompt to set the line number where the matches are displayed.

Duncan Roe

grep --line-buffered can also be you friend. E.g. tail -f logfile.log | grep --line-buffered -E -v stuff you don't want to see | less
Drive less as per previous post

enthuguy

ASKER

thanks all

Getting exicted now...will try this tomorrow and let you know :)

thanks again

enthuguy

ASKER

Hi ozo, do I need an package to be installed first ? please let me know

enthuguy

ASKER

I've requested that this question be closed as follows:

Accepted answer: 0 points for enthuguy's comment #37765497

for the following reason:

Not received additional info

serialband

There's mtail, which adds ansi coloring to log file terms and can be modified to produce exactly what you need.

http://matt.immute.net/src/mtail/

Duncan Roe

@enthuguy: what extra information were you waiting for? Ozo posted a Perl script - you will have Perl on your system. I tried a variant of his script and it worked fine

09:31:26$ cat ee90.pl
#!/usr/bin/perl
require Term::Cap;
my $term = Tgetent Term::Cap { TERM => undef, OSPEED => $ospeed };
my $so = $term->Tputs('so');
my $se = $term->Tputs('se');
open T,'tail --follow=name /var/log/debug|' or die $!;
$|=1;
while( <T> ){
    s/(MARK|error)/$so$1$se/g;
    print;
}

Open in new window

Substitute your file for /var/log/debug and your words of interest for MARK|error (any number of words, separated by bar characters)

Duncan Roe

I suggest split points between ozo http:#a37763873 and duncan_roe http:#a38161897. Ozo's post defined the basic mechanism but without sufficient instructions for enthuguy to understand how to use it - duncan_roe provided these instructions.