Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have various log files, some with the same format (webserver + webserver SSL), some with different formats and even different timestamps.

How can I correlate these log files together in a simple console tool?

Bonus question: Some logs might not have a timestamp in every line, such as exception logs - that start with a time stamp, followed by the exception:

2012-11-12T10:16:38+00:00 ERR (3): 
exception 'Exception' with message 'joinAttribute not implemented' in /var/foo/Bar.php:123
Stack trace:
share|improve this question
By "correlate," you mean...? – HopelessN00b Nov 13 '12 at 17:53
Show them in one file, ordered by the date the messages appeared. – Alex Nov 13 '12 at 17:59

You can use Simple Event Correlator (SEC) for this.

share|improve this answer
Sounds very interesting. Did you use it? Can you give an example to correlate two logs of the same webserver (same timestamp format etc.) ? – Alex Nov 13 '12 at 19:09
It's been around for a very long time. It is essentially a very well written perl script. There are tons of examples out there, just give it a good ol' googling :-) – Clayton Dukes Nov 13 '12 at 22:07
Can you give an example on how to use it to simply correlate two logs ? I did not find any :-( – Alex Dec 7 '12 at 15:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.