up vote 1 down vote favorite
share [g+] share [fb]

My jboss application server generate some pretty big log files, often around 8 to 10 gb.How can I view these log files in my redhat linux server?

link|improve this question
71% accept rate
2  
you should rotate those logs more often! – Javier Dec 27 '10 at 11:19
@Javier: the best general advice. Another catch is to direct different log levels to different files if this is possible. – halp Dec 27 '10 at 13:26
feedback

4 Answers

up vote 3 down vote accepted

Try using the split command.

split --bytes=100M <logfile> <logfile>

And yes, rotate your log files more often. It's a heinous crime not to.

link|improve this answer
4  
In this case split --lines= will be more comfortable, because you get full lines. With --bytes you might get only parts of the last line. – Christian Dec 27 '10 at 13:20
Yeh, True that. – malfy Dec 28 '10 at 1:05
feedback
up vote 3 down vote

I usually use less to view log files. It can view huge log files (multi-giga bytes). less is also capable of viewing compressed log files (ending with .gz).

You can also use grep to filter for specific pattern.

link|improve this answer
thanks.Its very difficult to analyse the log file with "less".do u have any other idea to open it? – Jayakrishnan T Dec 27 '10 at 12:41
You can search the file using grep as said in the answer. – Khaled Dec 27 '10 at 12:47
2  
With less you can search a string with a /, the string will be highlighted and then you can use F (shift F) to pass to append mode (aka tail -f ), this way, if you are looking for ERROR (/ERROR), every time there will be an ERROR this will be highlighted. Unlucky there is no magic to look at log files if you don't know what you are looking for exactly. – tmow Dec 27 '10 at 13:01
@Jayakrishnan T: What kind of analysis do you want to do ? – Iain♦ Dec 27 '10 at 13:19
feedback
up vote 1 down vote

You could also use a 'head' to list the first lines or a 'tail' to list the end of the file. If you append a number after the 'head' or the 'tail', it will display that number of lines.

Alan

link|improve this answer
feedback
up vote 0 down vote

We have a similar issue here (large logfiles though not JBoss), and all I can say is, "grep is your friend". I assume your logfiles look something like this: 

Dec 27 08:14:35 hostname kernel: bnx2: eth1 NIC Copper Link is Up, 1000 Mbps full duplex
Dec 27 08:14:35 hostname kernel: eth2: Link is Up 1000 Mbps Full Duplex, Flow Control: None
Dec 27 08:14:35 hostname kernel: eth3: Link is Up 1000 Mbps Full Duplex, Flow Control: None
Dec 27 08:14:36 hostname pcscd: hotplug_libusb.c:402:HPEstablishUSBNotifications() Driver ifd-egate.bundle does not support IFD_GENERATE_HOTPLUG. Using active polling instead.

(these are pulled from a /var/log/messages file, but the idea is that every entry is preceded by a timestamp).

Given that your logfile is filled with timestamps, what I do is something akin to the following:

grep '^`date "+%b %d"` 08:14' /my/log/file > /tmp/814amLog.txt

Which really is just grep'ing for today's timestamp, ie,

grep "^Dec 27 08:14" /my/log/file > /tmp/814amLog.txt

Then I less or vim -R the 814amLog.txt file. The idea is to get it into a bite-sized chunk that you're interested in.

The split command given as the first reply is usable, but in my experience gives rather arbitrary results. Usually I'm looking for something that happened "about this time". So grep'ing by date and time is used more often.

You can script a cron job to grep through your logfiles at night and save them in an appropriate place, so you don't have to do it adhoc. I also highly recommend creating a job to gzip compress log files older that a day or so, as you will be amazed at how much disk space you save.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.