How to monitor changes across several files in Linux?

Question

I want to monitor changes across several log files in Linux. Basically, I want to see which log file gets updated out of a set of 20 files. I have checked multitail tool, but its UI can handle max up to 5 files.

Any help is appreciated.

Answer 1

For what you propose, there's a lot of ways to do that depending on the situation.

Lightweight: Look into inotify

More fixtured (daemon): fam (File Alteration Monitor)

Or if it's not a common thing you'll be doing:

Or for a one off: watch -d -n 1 ls -t in the directory you want to watch (only in a flat directory, not recursive but you could modify it to do so) - then run tail on the result.

Answer 2

Keep it simple. tail -f

eg:

tail -f file1 file2 file3 file4 file5

Answer 3

If you are willing to do this from the command line you can use a script like this to do it

# When this exits, exit all back ground process also.
trap 'kill $(jobs -p)' EXIT

# iterate through the each given file names,
for file in "$@"
do
# show tails of each in background.
tail -f $file &
done

# wait .. until CTRL+C
wait

Save this file as multitail.sh or what ever you like then execute like this

./multitail.sh file.txt file1.txt file2.txt file3.txt file4.txt file5.txt I just ran this and it successfully ran 6 files, the down side is it only tells you what text has changed and not the filename of the text/log file. I have used this in the past. For more information etc have a look here http://www.thegeekstuff.com/2009/09/multitail-to-view-tail-f-output-of-multiple-log-files-in-one-terminal/ this person did a great writeup hope this helps

Answer 4

There are many ways to skin this cat... just for example....

you could aggregate the logs using logstash

if they were all in the same folder, you could generate a git repo to track the changes...

$ touch ~/test
$ git init
$ git add .
$ echo "##this is a comment" >> ~/test
$ git status | grep modified
=># modified:   test

you can configure monit to watch the checksum of the files,

check file /home/myhome/somefile.txt
    if changed checksum then alert

check file /home/myhome/somefile2.txt
    if changed checksum then alert

and maybe this might work...

check directory /home/myhome/
    if changed checksum then alert

or more light weight use inotify-tools to watch for changes;

inotifywait -m -r --format '%f' -e modify -e move -e create -e delete ~/test | while read line
do
    echo "hello $line"
done

Answer 5

If you really only want to see which file is changed, just list them with the right sorting option: ls -alt file1 file2 file3

This will display the most recent changed file on top.

You can even use a dynamic display: watch -n 1 ls -alt file1 file2 file3