Tools for Log Files

6.14 Identify and use trouble shooting commands (e.g., locate, find, grep, ?, <, >, >>, cat, tail)

Examining large amounts of log files can be very time-consuming. When you need information quickly, skimming through a large log file by using a text editor (such as vi), can be a daunting task.

You have many command line tools at your disposal, which will aid you in getting through your log files much easier.

cat: To view log files, use the cat command. cat is short for concatenate, which prints your file to a standard output. cat is usually used in conjunction with other commands to make viewing the log file an easier process. Using cat by itself prints the output of the specified file to the screen, but if the output comprises more than one page, it will quickly scroll to the end of the file, without giving you a chance to read it.

cat /var/log/messages: This command will print the entire file to the screen. If the file is very large, it will scroll by very quickly, and you may have to pause or cancel the output to read a particular section.

cat /var/log/messages | more: The pipe, “|”, takes the output of cat and sends it through the more command. The more command displays a text file one screen at a time, so that after you finish reading the first screen, you can press the spacebar to move to the next screen. This gives you a chance to review every line in the file.

head / tail: Sometimes, you may only want to view the first or last few lines of a log file because these include the first and most recent log entries. If you are using the cat or more command, you must wait until you reach the end of the file before you can see the last few log entries. The commands head and tail show you the first and last ten lines of the log file, respectively. For example, to see the first ten lines of your /var/log/dmesg file, use the following command:

head /var/log/dmesg

You can also input the number of lines that you want to see in the command output by adding an option with the number. For example, if you want to see the last fifty lines of dmesg log file, use the following command:

tail -50 /var/log/dmesg

You can also use the tail command to watch a log file as entries are being logged. This is useful if you are testing a command, process, or application in real-time, and you want to see the immediate result in the log file. For this situation, use the tail command with the “follow” option. For example:

tail -f /var/log/messages

Chapter 16 Linux Troubleshooting Basics 493

This command opens up the /var/log/messages file, and outputs log entries as they are added to the file.

grep: Because some of these log files can be very large, use other tools to narrow down the search so you can find an answer much more efficiently. One of the best tools to use is the grep command. Grep searches through a particular output file, and returns the results of a substring that you have specified. For example, you may want to scan your entire /var/log/messages file for any error messages by using the following command:

cat /var/log/messages | grep error

This sequence of commands tells the system to view the /var/log/messages file by using the command cat, which then sends the output to the grep command. The grep command searches the output for any lines in the log file that contain the word “error” and outputs them to the screen.

You can also use grep on its own to search a text file. The following example uses grep to search for the string “error” within the file /var/log/messages:

grep error /var/log/messages

special “operators”: operators, such as the question mark (?), will help you find expressions within a file. The question mark signifies that the preceding character is optional, and matched once at most. For example:

grep err?or /var/log/messages

This command will find the words, “error”, “eror”, but not “errror”.

Output to another file

You can also send the output of a file to another file by using the > and >> options. For example, suppose that you want to save the result of the preceding grep command to a separate file. The > option sends the output to a file of your choice:

cat /var/log/messages | grep error > error.log

The > option creates or overwrites the file that you specified. The >> option creates a new file if none exists, or adds the data to an existing file.

Locating files

If you are having difficulty finding a particular log or configuration file, you can use one of two commands for help. The locate command finds the location of any file that you are looking for. Simply enter a search string, and the locate command queries an internal database that stores the location of all the commands.