Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 5 down vote favorite
2

I need to monitor some large noisy log files (500m/day) from a Java application (log4j). Right now I manually look at the files, grep for "ERROR" and so on. However it should be possible for a tool to spot repeating patterns in the file, count them and provide drill down for the details of individual entries. Anyone know of such a tool? A text or Web based UI would be nice.

share|improve this question
1  
To me this question absolutely screams perl. – John Gardeniers Dec 19 '11 at 9:38
Hmm its starting to look like I will have to write a bash script with lots of greps. I was hoping to have something figure out the patterns automatically. – David Tinker Dec 22 '11 at 6:43
seriously, this is exactly what perl was created for. You can write a self-learning script for those patterns, although that's obviously out of scope here. – John Gardeniers Dec 22 '11 at 20:43

6 Answers

up vote 1 down vote accepted

I've heard of people applying Bayesian filtering on log files to spot interesting stuff versus routine log entries. They used spam filters, where the routine uninteresting entries were considered "good" while the unusual ones were considered as "spam" and using that coloring they were able to shift through.

It sounds a lot like machine learning stuff to me, but then again I've not seen it in action, only heard of it over beers.

share|improve this answer
This seems perfectly reasonable to me, and you could even have very strong prior assumptions (in the Bayesian sense) about certain words that always show up in server logs. – DrewConway Dec 19 '11 at 19:21
Yep this would do the job. Anyone know an implementation that I could train? – David Tinker Dec 22 '11 at 6:44
One could start with CRM114 I guess. Or wait until Drew Conway publishes his Machine Learning for Hackers. I am still working to find the original reference to what I proposed. – adamo Dec 22 '11 at 8:36
Yep! I read it back in 2005 in this sage-members thread . The author of the email mentions spamprobe. – adamo Dec 22 '11 at 8:45
up vote 4 down vote

Splunk works wonders for this sort of stuff. I use it internally to gather all the logs and do quick searches via its excellent browser-based interface.

share|improve this answer
Unfortunately we would likely need the non-free version and its a bit expensive – David Tinker Dec 22 '11 at 6:34
up vote 2 down vote

syslog-ng has a patterndb named feature. You can make patterns and match log entries to them in real time then send those entries to separate logfiles.

share|improve this answer
up vote 1 down vote

While looking into syslog-ng and patterndb (+1 to that answer, above), I encountered a web-based tool called ELSA: http://code.google.com/p/enterprise-log-search-and-archive/. It's F/OSS in perl, with a web interface, and supposed to be really fast.

I haven't tried it yet, but once I'm done filtering using patterndb, I'll be trying ELSA.

share|improve this answer
up vote 1 down vote

Try out petit.
I'm not sure if it will work with log4j format, but you might be able to write a custom filter for that.
Petit has no web interface, it displays graphs in your shell (ASCII art ftw!).
It's very useful to quickly see repeating messages and figure out when they happened or started to happen more frequently.

share|improve this answer
up vote 0 down vote

If you are using debian/squeeze on your server, have a look at log2mail: http://packages.debian.org/squeeze/log2mail

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.