5

I often need to search through logs while I'm SSH'd into my servers. I know there are commands like grep that can assist me. But I need to find certain terms and see the logs around those lines which is a huge pain to do with just commands.

Is there any SSH client out there that will allow me to essentially just ctrl+f and search logs for specific commands?

Thank you

4
  • Consider that the CTRL key is forwarded to the session, you can try right-clicking the title bar, and looking for the find option. On PowerShell, it is under the Edit menu.
    – Marco Zink
    Aug 16, 2022 at 17:00
  • 1
    "I need to find certain terms and see the logs around those lines" - that's exactly what grep does, no?
    – Bergi
    Aug 17, 2022 at 1:20
  • 5
    Look at the -A and -B parameters to grep. For example, grep -B 3 -A 10 foo will give you the three lines before and ten lines after each occurrence of "foo".
    – Mark
    Aug 17, 2022 at 2:55
  • 3
    @Mark Or grep -C 5 foo for 5 lines either way. It's shorter, so I tend to use that more.
    – marcelm
    Aug 17, 2022 at 7:12

5 Answers 5

10

You are using a remote session and execute all commands on the remote system.

On *nix based systems you can use less to browse and execute powerful search commands (regex). On Windows based systems is no integrated command as powerful as less.

3
  • "On Windows based systems is no integrated command as powerful as less." Well, docs.microsoft.com/en-us/powershell/module/…
    – mfinni
    Aug 16, 2022 at 16:50
  • Yes, that's possible. But there is no built in command to page forward/backward and search regex.
    – M. Behrens
    Aug 16, 2022 at 17:06
  • 2
    select-string does indeed support regex, but you're correct, it's not a pager, more like grep than less
    – mfinni
    Aug 16, 2022 at 17:26
5

This is pretty much a shopping question, but there's a technical answer valid for almost any windows SSH client. Configure it to log to a file, pref a new one with hostname and timestamp in the filename for each session, and keep a view of that logfile in another window, pref from a GUI log viewer that will tail and optionally highlight or pin your search terms

2

A completely different approach: if you need to do this on a regular basis consider setting up a dedicated log host.

Set up an ELK stack and configure your servers to log into it, this will allow you to easily filter log entries even over multiple services and servers.

2

You are probably mixing things up a little bit, but that depends a bit on what you actually want to do.

If you connect to your remote server, start some process which generates a lot of output (shown directly on screen in your ssh window while you run it), and you want to search for something in that output, you can either:

  • use your ssh client's "scroll back" memory (which is usually limited in size, but configurable). Many ssh clients will allow you to search in that memory and then you can scroll back and forth using the window's scroll bars

  • pipe the output of the command to less. So if your command is super_script you just type super_script | less. See below for navigation using less.

  • save the output of the command to a file, which you'll then be able to view using less (or possibly an editor like vim or nano or many others, depending on the size of the output). To save the output, redirect the output to a file: super_script > output.txt. You can then less output.txt for instance, or any of the other tools listed below

If you need to examine existing log files from already running processes (e.g. a web server or cron jobs), then the files are already there. Then you have multiple options to navigate through them:

  • If you want to examine the end of the log, you can use tail (e.g. tail /var/log/whatever.log). You can specify how many lines you want to see (tail -50 whatever.log to see the last 50 lines)

  • if the process is currently running and adding output to the logs (but at a relatively slow rate), you can use tail -f to see the end of the log and anything that is added to it in "real time"

  • if the log is not too large, you could use any editor to view its contents. But of course vim is probably not the easiest option for beginners

  • For logs of any size, you can use less. It will load just the part currently displayed and forget the rest, which makes it possible to navigate through extremely large files. If the file is large, it is recommended to use the -n option (i.e. less -n whatever.log) so tell less not to waste time trying to count the number of lines in the file.

    • To find an occurence of a string (the equivalent of ctrl-f in many places in Windows), type / followed by the string you're looking for. You can then use n to find the next one. You can always scroll up and down using arrows to see context.

    • If the file is large, you can go directly to the end using G (shift-g), then search for the last previous occurrence of a string using ? and the string you're looking for (reverse search).

    • If the file is large and you know vaguely where you think the target is, you can type a number followed by % to get to that percentage of the file. For instance it's a log file for a full month and you want to go to the 10th of the month, so about 33%, type 33%. This can save time avoiding searches from the start of the file.

    • There are many other options for navigation using less. Type h to view the help screen in less.

  • grep which you mentioned also allows you to specify you want some context: -A followed by a number tells it to output that number of lines after the match, and -B the same for before. So grep -A 10 -B 10 ouhlala whatever.log will find all lines containing "ouhlala" but, for each of them, also print 10 lines before and 10 lines after.

  • Yet another alternative is to copy the file from your remote server to your local computer and use whatever tools you are used to there, but I personally prefer Unix tools to anything else when it comes to managing large log files.

0

This is likely to be better solved on the server itself.

The ‘traditional’ option is to use a pager, which is a program that simply displays the contents of a file and allows you to easily navigate around them. less is the de-facto standard option for this on most UNIX-like systems, though there are plenty of other options. Pretty much all decent pagers (read as ‘almost anything other than more and it’s direct clones) let you search in the file in some way (in less, hit / and then type in any POSIX basic regular expression) and jumping to specific lines, and many support more complex navigation (such as jumping to matching parenthesis or braces). Normal pager programs either take the text to display on standard input, or display whatever file you pass as an option.

A slightly more typical approach these days is to open the file in whatever text editor you normally use, and search that way. Some text editors even have specific read-only modes for this usage (for example, Vim's view alias).

Better yet than either approach though is to use a tool like GNU screen or tmux to get a configurable scrollback buffer on the server itself, which can be searched directly on the server, or can be saved to a file if you want. This also gets you a bunch of other useful features, such as being able to resume interrupted SSH sessions (by just reattaching to the existing session) and having multiple shells or programs open at the same time on one session.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .