Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Are there any nice tools for doing a 'tail -f' on a remote (linux) server? It would be nice to be able to do something like "taillog server_host /var/log/syslog" to view logs on various servers without having to ssh in.

How about an app that shows multiple logs side-by-side?

share|improve this question

11 Answers 11

up vote 15 down vote accepted

If the log files are being generated on the client server via the syslog facility then the best way is to setup the clients syslog daemon to forward those logs to a seperate host. For example, if I have an internal name syslog.private which points to the remote server that I want to receive the log entries. I can add the following line to the /etc/syslog.conf on the client server.

*.*          @syslog.private

and then restart the syslog daemon on the client

service syslog reload

This will cause every entry that passes through the clients syslog to be sent across the wire to syslog.private and if that machine is configured correctly, the entries will be available there as well. In RedHat systems this is controlled by the /etc/sysconfig/syslog file. Make sure the -r option is present

% grep "SYSLOGD" /etc/sysconfig/syslog 
SYSLOGD_OPTIONS="-m 0 -r"

and then restart the syslog daemon on the receiving server.

You can also control what is forwarded to the remote server by adding exclusions, see the example below

*.*;mail.none   @syslog.private

Which says forward everything to syslog.private with the exception of anything sent to the mail facility.

If this solution works out for you, you may consider one of the alternate syslog implementations like rsyslog, or syslog-ng, which provide extra logging and storage options.

share|improve this answer
1  
+1. Centralized log-repositories are essential imo. It is very nice to have a clean set of logs after a breakin. Well, its not guaranteed clean, since they can be poisoned by an attacker. But the attacker can't remove anything. –  Commander Keen May 19 '09 at 8:43
    
Then using multitail or sperlunk on your central logging server is a great way to get a feel for your entire network –  Dave Cheney May 19 '09 at 10:30

If you setup key-based ssh authentication and sudo on the remote hosts on the remote hosts to allow running tail against the log files without password prompting. It would be pretty easy to build a taillog script that does what you want like below. This doesn't really avoid ssh, but it does save you a couple steps.

#!/bin/bash
ssh $1 sudo tail -f $2

Or, you could setup syslog to forward all the log messages to a central system and then run your tail command on the syslog server. Just watch the log files on the central system.

share|improve this answer
    
Thanks - this is pretty useful! –  ro. Nov 29 '09 at 3:11

I would highly recommend multitail for advanced log viewing. Self described as tail on steroids.

share|improve this answer
    
I just had a vote-down not 15 hours ago for that suggestion. I will uncloak the posting... –  Avery Payne May 19 '09 at 16:44
    
Hmm, yeah I don't think multitail is an exact answer to the question but I think its valuable enough to be included in the answer. A vote down for it is quite harsh. –  gacrux May 20 '09 at 14:41
    
agree unfair.... multi-log answers one half of this two part question - the 'side-by-side' part. (vimdiff also does a nice job, or vim -O at least) just because it doesn't address the remote part is likely the issue. –  ericslaw Jun 19 '09 at 22:57

This is clearly not answering your question, but if you have more than a few logs to watch, and less than the free edition limit, you can try Splunk for free to have a nice interface and useful to all your logging data.

tail -f does support more than one log, but not side by side, only downwards.

share|improve this answer
    
Splunk has a tail feature that you can use to do remote tail -f on a file. I don't believe it does side-by-side, though. –  thepocketwade Jul 20 '09 at 17:54

Multitail will do what you're after on the local machine. It does not specifically mention if it will work across a network, although there are several ways to work around that (NFS mounts, SMB mounts, etc.) It also says it will work as a syslog server, which implies that it might be able to receive active data from another machine's syslog, although I have never used that feature and don't know if that's the case.

share|improve this answer

I wrote vsConsole for exactly this purpose - easy access to log files (sshing and file permissions are always a problem) - and then added app monitoring and version tracking. I would like to know what you think of it. http://vs-console.appspot.com/

This is meant to be an easy, low learning curve, one click solution solving common development problems I've always needed a simple solution for.

share|improve this answer

You could use something like Phplogcon. I use rsyslog with mysql and send all logs from my other servers to it. Phplogcon then displays them through the use of a web application.

It's not the best looking interface but it's a nice way for admins to access logs without exposing the servers to unnecessary remote logins.

share|improve this answer

Already mentioned, but worth mentioning again. SPLUNK!

I've had the pleasure of building big central syslog setups with a nice gui in the past. It's a world of pain. Splunk makes it a doddle, especially with an enterprise license tha give you central managment. If your logs are under 500M a day, it's free. If not, it can get very expensive, but it is worth it and not just for a little bit of logging - you can do a lot more. I'd usually advocate open source apps, but Splunk beats anything I've come across.

share|improve this answer

Try this:

ssh servername tail -f /var/log/messages

If your log file is protected:

ssh -f servername sudo tail -f /var/log/messages

(you don't have to use "ssh -f" - it's just so your password is not echoed to the TTY)

If you like that you can use the same command with cluster SSH.

share|improve this answer

You can also use Octopussy (my project) to centralize your logs, view and generate alerts and reports.

share|improve this answer

I'm using OtrosLogViewer (apache commons license). It supports tailing log from remote servers using ssh/sftp and samba/CIFS. You can tail multiply log files into one window. Here is a screenshot: OtrosLogViewer screenshot

share|improve this answer
    
do you have a pattern to linux syslog file ? –  Edgard Leal 6 hours ago

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.