Is there a log file analyzer for log4j files?

Question

I am looking for some kind of analyzer tool for log files generated by log4j files. I am looking something more advanced than grep? What are you using for log file analysis?

I am looking for following kinds of features:

• The tool should tell me how many time a given log statement or a stack trace has occurred, preferably with support for some kinds of patterns (eg. number of log statements matching 'User [a-z]* logged in').
• Breakdowns by log level (how many INFO, DEBUG lines) and by class that initiated the log message would be nice.
• Breakdown by date (how many log statements in given time period)
• What log lines occur commonly together?
• Support for several files since I am using log rolling
• Hot spot analysis: find if there is a some time period when there is unusually high number of log statements
• Either command-line or GUI are fine
• Open Source is preferred but I am also interested in commercial offerings

My log4j configuration uses org.apache.log4j.PatternLayout with pattern %d %p %c - %m%n but that could be adapted for analyzer tool.

Answer 1

Take a look at Apache Chainsaw http://logging.apache.org/chainsaw/index.html for your needs

Answer 2

I'd suggest Splunk. It provides fast, Google-like searching across lots (terabytes) of logs, is easy to filter (e.g. by log level or date), makes it easy to correlate into transactions of multiple related log events, etc.

There's a downloadable version that's free as long as you're indexing less than 500MB of logs per day.

Answer 3

(disclaimer: I'm one of the developers contributing to Chainsaw V2)

Chainsaw V2 can provide some of the functionality you're looking for through its support for custom expressions and the ability to use those expressions to colorize, search and filter events.

You -can- load multiple log files into Chainsaw (by default, all events for a log file are placed on a logfile-specific tab). You can also define a 'custom expression logpanel' which will aggregate events from all tabs into a new tab matching an expression you provided - similar to a database 'view', you could use the expression 'LEVEL >= WARN' to collect all warnings, error & fatal messages from any log file into a single view.

Some example expressions which could be used to colorize, search or filter events:

• msg like 'User [a-z]* logged in'
• msg ~= login || msg ~= logout
• level > INFO
• exception exists
• timestamp <= '2010/04/06 15:05:35'

The only way to get 'counts' currently is to define an expression in the 'refine focus' field (the count of events matching the expression will show in the status bar).

One of the useful features added to the upcoming release is a clickable bar to the right of the table (similar to Eclipse or Idea's bar showing syntax error indications) which will display color rule and search expression matches for the entire log file.

When the next version of Chainsaw V2 comes out, I hope you give it a spin - it's Open Source, free, and we're always interested in suggestions & feedback.