Skip to content
Register

Reading server logs without going blind

Web Hosting by PetraSuper 24 replies 2.8K views
PetraSuper

Member OP

network boot believer

9 #1

Hej friends, I write small guide because I spend four hours chasing own IP in logs yesterday

No, problem is not tool, is eyes. I try show what works on malý server.

tool I use now

  • Lnav — color from box, no config
  • Ccze — if you want pipe anything
  • Tail -f with grep --color=always

My color scheme: black background, green for 2xx, yellow 3xx, red error. No blue, blue is invisible.

For nginx I make alias:

alias tailerr='tail -f /var/log/nginx/error.log | ccze -A'

No, this is not perfect. But better than white terminal at 3am.

What you use? I am curious.

boot anything, anywhere, anytime
SU

Member

#2

=

Mas lnav? Tipo

Ccze

grep --color=always

SY

Member

4 #3

Don't overlook Windows Server's built-in log parsing. Event Viewer has had color filtering since 2016. Not trying to start a war here, just mentioning it for anyone managing mixed environments.

marcus_qc

Member

#4

Hey folks

Super stoked on this thread

My move is awk one-liner for 5xx spikes:

awk '$9 ~ /^5/ {print $1, $4, $7}' access.log

Admit I used to cat everything then I learned about less +F

Live and grow

42U and still growing
Bruno22

Member

#5

Very good guide PetraSuper.

We make a test with ccze on malý server from InterServer, is very good.

My awk is more simple:

awk '{print $1}' | sort | uniq -c | sort -rn

For find who attack

Lnav + ccze = perfect combination!

ping so high I wave back
dave39

Member

#6

I concede color helps,,,,, My terminal is amber on black like the old days,,,,, I cat logs into ccze when I must,,,,, Mostly I grep for scrap patterns the gods whisper,,,,, Four hours for own IP is rookie mistake dave made too,,,,, Now I whitelist home in head of every awk chain,,,,,

~~dave

pablo

Member

#7

Lnav from box no config ? Wey thats fire bro no cap

declarative or death
minh1987

Member

#8

Event Viewer color filtering since 2016? Which build exactly

phở at 3AM, deploy at 4
armstrongvds

Member

ARM Enjoyer

#9

What is your malý server spec, the OS version?

one small ping for man...
AL

Member

#10

Following.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft