Pro Tips: Color Your Tail With Perl
We ran into a situation today where our JEE server was logging everything twice. Sadly, this meant that errors and warnings were logged as INFO and were missed.
2011-03-22 11:40:40,884 INFO [STDOUT] (main) 11:40:40,884 WARN [ProcessRoles] Could NOT find role XXXX
Since we watched the logs most often using the tail command, the quick and dirty solution was to have tail output lines containing WARN/ERROR/SEVERE in different colors that would stand out as the scrolled past. The bash/perl script below is the fruit of my hacking. Suggestions for improvements welcome.
t() {
tail -100f $1 | perl -pe 's/^.*SEVERE.*$/\e[1;37;45m$&\e[0m/g' | perl -pe 's/^.*ERROR.*$/\e[1;37;41m$&\e[0m/g' | perl -pe 's/^.*WARN.*$/\e[1;33;40m$&\e[0m/g'
}
Two Guys Arguing 
[…] 2011-03-22 11:40:40,884 INFO [STDOUT] (main) 11:40:40,884 WARN [ProcessRoles] Could NOT find… [full post] benjaminplee Two Guys Arguing javalinuxbashlogs 0 0 0 0 […]
That’s not the most efficient way to do things: you are invoking perl three times in the pipeline, and needlessly considering SEVERE lines as maybe ERROR or WARN. A small improvement would be to invoke perl only once and use the ‘||’ operator to short-circuit. As the ‘-p’ is processing a line at a time, you probably don’t need the ‘g’ regex modifier. This works for me:
tail -100f $1 | perl -ple ‘s/^.*SEVERE.*$/\e[1;37;45m$&\e[0m/ || s/^.*ERROR.*$/\e[1;37;41m$&\e[0m/ || s/^.*WARN.*$/\e[1;33;40m$&\e[0m/’
Of course there are tools out there to do this sort of thing, for example colortail and ccze .
Very nice, thanks. Mine was a complete quick and dirty hack. Thanks for the improvement.
Here’s how I streamlined my colorized Exim mainlog tail. Using a || for each pattern is nuts. In my example below I group them by color:
tail -f /var/log/exim_mainlog | perl -pe ‘s/.*\b(error|defer|rejected|fail|failed|unexpected)\b.*/\e[1;31;40m$&\e[0m/g || s/.*\b(Completed|closed)\b.*/\e[1;32;40m$&\e[0m/g || s/.*\b(bypassed|blackhole|Warning|lost|no IP|no host)\b.*/\e[1;33;40m$&\e[0m/g || s/.*\b(count|outbound)\b.*/\e[1;36;40m$&\e[0m/g’