How to monitor changes across several files in Linux?
772
I want to monitor changes across several log files in Linux. Basically, I want to see which log file gets updated out of a set of 20 files. I have checked multitail tool, but its UI can handle max up to 5 files.
For what you propose, there's a lot of ways to do that depending on the situation.
Lightweight: Look into inotify
More fixtured (daemon): fam (File Alteration Monitor)
Or if it's not a common thing you'll be doing:
Or for a one off: watch -d -n 1 ls -t in the directory you want to watch (only in a flat directory, not recursive but you could modify it to do so) - then run tail on the result.
If you are willing to do this from the command line you can use a script like this to do it
# When this exits, exit all back ground process also.
trap 'kill $(jobs -p)' EXIT
# iterate through the each given file names,
for file in "$@"
do
# show tails of each in background.
tail -f $file &
done
# wait .. until CTRL+C
wait
Save this file as multitail.sh or what ever you like then execute like this
./multitail.sh file.txt file1.txt file2.txt file3.txt file4.txt file5.txt
I just ran this and it successfully ran 6 files, the down side is it only tells you what text has changed and not the filename of the text/log file. I have used this in the past. For more information etc have a look here http://www.thegeekstuff.com/2009/09/multitail-to-view-tail-f-output-of-multiple-log-files-in-one-terminal/
this person did a great writeup
hope this helps
For what you propose, there's a lot of ways to do that depending on the situation.
Lightweight: Look into
inotify
More fixtured (daemon):
fam
(File Alteration Monitor)Or if it's not a common thing you'll be doing:
Or for a one off:
watch -d -n 1 ls -t
in the directory you want to watch (only in a flat directory, not recursive but you could modify it to do so) - then run tail on the result.Keep it simple.
tail -f
eg:
If you are willing to do this from the command line you can use a script like this to do it
Save this file as multitail.sh or what ever you like then execute like this
./multitail.sh file.txt file1.txt file2.txt file3.txt file4.txt file5.txt I just ran this and it successfully ran 6 files, the down side is it only tells you what text has changed and not the filename of the text/log file. I have used this in the past. For more information etc have a look here http://www.thegeekstuff.com/2009/09/multitail-to-view-tail-f-output-of-multiple-log-files-in-one-terminal/ this person did a great writeup hope this helps
There are many ways to skin this cat... just for example....
you could aggregate the logs using logstash
if they were all in the same folder, you could generate a git repo to track the changes...
you can configure monit to watch the checksum of the files,
and maybe this might work...
or more light weight use inotify-tools to watch for changes;
If you really only want to see which file is changed, just list them with the right sorting option:
ls -alt file1 file2 file3
This will display the most recent changed file on top.
You can even use a dynamic display:
watch -n 1 ls -alt file1 file2 file3