I want to monitor changes across several log files in Linux. Basically, I want to see which log file gets updated out of a set of 20 files. I have checked multitail tool, but its UI can handle max up to 5 files.
Any help is appreciated.
For what you propose, there's a lot of ways to do that depending on the situation.
Lightweight: Look into
More fixtured (daemon):
fam (File Alteration Monitor)
Or if it's not a common thing you'll be doing:
Or for a one off:
watch -d -n 1 ls -t in the directory you want to watch (only in a flat directory, not recursive but you could modify it to do so) - then run tail on the result.
If you are willing to do this from the command line you can use a script like this to do it
# When this exits, exit all back ground process also. trap 'kill $(jobs -p)' EXIT # iterate through the each given file names, for file in "$@" do # show tails of each in background. tail -f $file & done # wait .. until CTRL+C wait
Save this file as multitail.sh or what ever you like then execute like this
./multitail.sh file.txt file1.txt file2.txt file3.txt file4.txt file5.txt I just ran this and it successfully ran 6 files, the down side is it only tells you what text has changed and not the filename of the text/log file. I have used this in the past. For more information etc have a look here http://www.thegeekstuff.com/2009/09/multitail-to-view-tail-f-output-of-multiple-log-files-in-one-terminal/ this person did a great writeup hope this helps
There are many ways to skin this cat... just for example....
you could aggregate the logs using logstash
if they were all in the same folder, you could generate a git repo to track the changes...
$ touch ~/test $ git init $ git add . $ echo "##this is a comment" >> ~/test $ git status | grep modified =># modified: test
you can configure monit to watch the checksum of the files,
check file /home/myhome/somefile.txt if changed checksum then alert check file /home/myhome/somefile2.txt if changed checksum then alert
and maybe this might work...
check directory /home/myhome/ if changed checksum then alert
or more light weight use inotify-tools to watch for changes;
inotifywait -m -r --format '%f' -e modify -e move -e create -e delete ~/test | while read line do echo "hello $line" done
Keep it simple.
tail -f file1 file2 file3 file4 file5
If you really only want to see which file is changed, just list them with the right sorting option:
ls -alt file1 file2 file3
This will display the most recent changed file on top.
You can even use a dynamic display:
watch -n 1 ls -alt file1 file2 file3