1

My jboss application server generate some pretty big log files, often around 8 to 10 gb.How can I view these log files in my redhat linux server?

2
  • 2
    you should rotate those logs more often!
    – Javier
    Dec 27, 2010 at 11:19
  • @Javier: the best general advice. Another catch is to direct different log levels to different files if this is possible.
    – halp
    Dec 27, 2010 at 13:26

4 Answers 4

3

Try using the split command.

split --bytes=100M <logfile> <logfile>

And yes, rotate your log files more often. It's a heinous crime not to.

2
  • 4
    In this case split --lines= will be more comfortable, because you get full lines. With --bytes you might get only parts of the last line.
    – Christian
    Dec 27, 2010 at 13:20
  • Yeh, True that.
    – atx
    Dec 28, 2010 at 1:05
3

I usually use less to view log files. It can view huge log files (multi-giga bytes). less is also capable of viewing compressed log files (ending with .gz).

You can also use grep to filter for specific pattern.

4
  • thanks.Its very difficult to analyse the log file with "less".do u have any other idea to open it? Dec 27, 2010 at 12:41
  • You can search the file using grep as said in the answer.
    – Khaled
    Dec 27, 2010 at 12:47
  • 2
    With less you can search a string with a /, the string will be highlighted and then you can use F (shift F) to pass to append mode (aka tail -f ), this way, if you are looking for ERROR (/ERROR), every time there will be an ERROR this will be highlighted. Unlucky there is no magic to look at log files if you don't know what you are looking for exactly.
    – tmow
    Dec 27, 2010 at 13:01
  • @Jayakrishnan T: What kind of analysis do you want to do ?
    – user9517
    Dec 27, 2010 at 13:19
1

You could also use a 'head' to list the first lines or a 'tail' to list the end of the file. If you append a number after the 'head' or the 'tail', it will display that number of lines.

Alan

0

We have a similar issue here (large logfiles though not JBoss), and all I can say is, "grep is your friend". I assume your logfiles look something like this:

Dec 27 08:14:35 hostname kernel: bnx2: eth1 NIC Copper Link is Up, 1000 Mbps full duplex
Dec 27 08:14:35 hostname kernel: eth2: Link is Up 1000 Mbps Full Duplex, Flow Control: None
Dec 27 08:14:35 hostname kernel: eth3: Link is Up 1000 Mbps Full Duplex, Flow Control: None
Dec 27 08:14:36 hostname pcscd: hotplug_libusb.c:402:HPEstablishUSBNotifications() Driver ifd-egate.bundle does not support IFD_GENERATE_HOTPLUG. Using active polling instead.

(these are pulled from a /var/log/messages file, but the idea is that every entry is preceded by a timestamp).

Given that your logfile is filled with timestamps, what I do is something akin to the following:

grep '^`date "+%b %d"` 08:14' /my/log/file > /tmp/814amLog.txt

Which really is just grep'ing for today's timestamp, ie,

grep "^Dec 27 08:14" /my/log/file > /tmp/814amLog.txt

Then I less or vim -R the 814amLog.txt file. The idea is to get it into a bite-sized chunk that you're interested in.

The split command given as the first reply is usable, but in my experience gives rather arbitrary results. Usually I'm looking for something that happened "about this time". So grep'ing by date and time is used more often.

You can script a cron job to grep through your logfiles at night and save them in an appropriate place, so you don't have to do it adhoc. I also highly recommend creating a job to gzip compress log files older that a day or so, as you will be amazed at how much disk space you save.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .