Viewing Unix Log Files

Question

We are having a discussion at work, what is the best UNIX command tool that to view log files. One side says use LESS, the other says use MORE. Is one better than the other?

Answer 1

u may use any programs: less, nano, vi, tail, cat etc, they differents by functionality, so exists any log viewers: gnome-system-log, kiwi etc (they can sort log by date / type etc)

Answer 2

Less is more. Although since when I'm looking at my logs I'm typically searching for something specific or just interested in the last few events I find myself using cat, pipes and grep or tail rather than more or less.

Answer 3

less is the best, imo. It is light weight compared to an editor, it allows forward and backward navigation, it has powerful search capabilities, and many more things. Hit 'h' for help. It's well worth the time getting familiar with it.

Answer 4

I opt for less. A reason for this is that (with aid of lessopen) it can read gzipped log (as archived by logrotate).

As an example with this single command I can read in time ordered mode dpkg log, without treating differently gzipped ones:

less $(ls -rt /var/log/dpkg.log*) | less

Answer 5

A common problem is that logs have too many processes writing to them, I prefer to filter my log files and control the output using:

tail -f /var/log/<some logfile> | grep <some identifier> | more

This combination of commands allows you to watch an active log file without getting overwhelmed by the output.

Answer 6

On my Mac, using the standard terminal windows, there's one difference between less and more, namely, after exiting:

• less leaves less mess on my screen
• more leaves more useful information on my screen

Consequently, if I think I might want to do something with the material I'm viewing after the viewer finishes (for example, copy'n'paste operations), I use more; if I don't want to use the material after I've finished, then I use less.

The primary advantage of less is the ability to scroll backwards; therefore, I tend to use less rather than more, but both have uses for me. YMMV (YMWV; W = Will in this case!).

Answer 7

Multitail is the best option, because you can view multiple logs at the same time. It also colors stuff, and you can set up regex to highlight entries you're looking for.