1

I have various log files, some with the same format (webserver + webserver SSL), some with different formats and even different timestamps.

How can I correlate these log files together in a simple console tool?

Bonus question: Some logs might not have a timestamp in every line, such as exception logs - that start with a time stamp, followed by the exception:

2012-11-12T10:16:38+00:00 ERR (3): 
exception 'Exception' with message 'joinAttribute not implemented' in /var/foo/Bar.php:123
Stack trace:
2
  • By "correlate," you mean...? Nov 13, 2012 at 17:53
  • Show them in one file, ordered by the date the messages appeared.
    – Alex
    Nov 13, 2012 at 17:59

1 Answer 1

1

You can use Simple Event Correlator (SEC) for this.

http://simple-evcorr.sourceforge.net/

3
  • Sounds very interesting. Did you use it? Can you give an example to correlate two logs of the same webserver (same timestamp format etc.) ?
    – Alex
    Nov 13, 2012 at 19:09
  • It's been around for a very long time. It is essentially a very well written perl script. There are tons of examples out there, just give it a good ol' googling :-) Nov 13, 2012 at 22:07
  • Can you give an example on how to use it to simply correlate two logs ? I did not find any :-(
    – Alex
    Dec 7, 2012 at 15:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .