I need to monitor some large noisy log files (500m/day) from a Java application (log4j). Right now I manually look at the files, grep for "ERROR" and so on. However it should be possible for a tool to spot repeating patterns in the file, count them and provide drill down for the details of individual entries. Anyone know of such a tool? A text or Web based UI would be nice.
9 Answers
I've heard of people applying Bayesian filtering on log files to spot interesting stuff versus routine log entries. They used spam filters, where the routine uninteresting entries were considered "good" while the unusual ones were considered as "spam" and using that coloring they were able to shift through.
It sounds a lot like machine learning stuff to me, but then again I've not seen it in action, only heard of it over beers.
-
This seems perfectly reasonable to me, and you could even have very strong prior assumptions (in the Bayesian sense) about certain words that always show up in server logs. Dec 19, 2011 at 19:21
-
Yep this would do the job. Anyone know an implementation that I could train? Dec 22, 2011 at 6:44
-
One could start with CRM114 I guess. Or wait until Drew Conway publishes his Machine Learning for Hackers. I am still working to find the original reference to what I proposed.– adamoDec 22, 2011 at 8:36
-
Yep! I read it back in 2005 in this sage-members thread . The author of the email mentions spamprobe.– adamoDec 22, 2011 at 8:45
Splunk works wonders for this sort of stuff. I use it internally to gather all the logs and do quick searches via its excellent browser-based interface.
-
Unfortunately we would likely need the non-free version and its a bit expensive Dec 22, 2011 at 6:34
syslog-ng has a patterndb named feature. You can make patterns and match log entries to them in real time then send those entries to separate logfiles.
While looking into syslog-ng and patterndb (+1 to that answer, above), I encountered a web-based tool called ELSA: http://code.google.com/p/enterprise-log-search-and-archive/. It's F/OSS in perl, with a web interface, and supposed to be really fast.
I haven't tried it yet, but once I'm done filtering using patterndb, I'll be trying ELSA.
Try out petit.
I'm not sure if it will work with log4j format, but you might be able to write a custom filter for that.
Petit has no web interface, it displays graphs in your shell (ASCII art ftw!).
It's very useful to quickly see repeating messages and figure out when they happened or started to happen more frequently.
If you are using debian/squeeze on your server, have a look at log2mail: http://packages.debian.org/squeeze/log2mail
Glogg is a very good log explorer as you have the possibility to create filter base on string and color line or retrieve all occurrence to a string.
You can try SEQREL's LogXtender, that automatically detects patterns and aggregates similar logs. The way does it is by creating regular expressions on the fly and using the cached regex to match other logs. With additional taxonomy detection more granularity can be added. A free version can be downloaded under https://try.logxtender.net.
perl
.