View log files with emacs

View log files with emacs

[Eike]

Hello all,

I have to look at some log files more often now and was wondering if
there are some handy things for emacs in that regard? I'm aware of
log4j-mode, but couldn't find more. It's for java (logback and log4j)
log files so I'd like to do fold stacktraces etc and also remove certain
parts I'm not interested in to make the file smaller (we seem to log
more useless than useful stuff…).

Thanks for any hints and tips
Regards,
Eike


--
gpg: AD7AC35E
finger print: 137F BB0B 1639 D25F DC5D  E59C B412 C5F5 AD7A C35E

RE: View log files with emacs

[Drew Adams]

> I have to look at some log files more often now and was wondering if
> there are some handy things for emacs in that regard? I'm aware of
> log4j-mode, but couldn't find more. It's for java (logback and log4j)
> log files so I'd like to do fold stacktraces etc and also remove certain
> parts I'm not interested in to make the file smaller (we seem to log
> more useless than useful stuff…).

I see this library when I search for "log" on Emacs Wiki.
No idea how helpful it will be for you, however.

http://www.emacswiki.org/emacs/syslog-mode.el

Re: View log files with emacs

[Alex Kost]

Drew Adams (2015-02-17 18:43 +0300) wrote:

>> I have to look at some log files more often now and was wondering if
>> there are some handy things for emacs in that regard? I'm aware of
>> log4j-mode, but couldn't find more. It's for java (logback and log4j)
>> log files so I'd like to do fold stacktraces etc and also remove certain
>> parts I'm not interested in to make the file smaller (we seem to log
>> more useless than useful stuff…).
>
> I see this library when I search for "log" on Emacs Wiki.
> No idea how helpful it will be for you, however.
>
> http://www.emacswiki.org/emacs/syslog-mode.el

It is maintained at <https://github.com/vapniks/syslog-mode> and it's
available on MELPA.

-- 
Alex

Re: View log files with emacs

[Eike]

Alex Kost writes:

> Drew Adams (2015-02-17 18:43 +0300) wrote:
>
>>> I have to look at some log files more often now and was wondering if
>>> there are some handy things for emacs in that regard? I'm aware of
>>> log4j-mode, but couldn't find more. It's for java (logback and log4j)
>>> log files so I'd like to do fold stacktraces etc and also remove certain
>>> parts I'm not interested in to make the file smaller (we seem to log
>>> more useless than useful stuff…).
>>
>> I see this library when I search for "log" on Emacs Wiki.
>> No idea how helpful it will be for you, however.
>>
>> http://www.emacswiki.org/emacs/syslog-mode.el
>
> It is maintained at <https://github.com/vapniks/syslog-mode> and it's
> available on MELPA.

Ah, I really missed this one although I was searching through the melpa
package list… thank you! This looks good at first sight.

Re: View log files with emacs

[Steinar Bang]

>>>>> Alex Kost <alezost@gmail.com>:
> Drew Adams (2015-02-17 18:43 +0300) wrote:

>>> I have to look at some log files more often now and was wondering if
>>> there are some handy things for emacs in that regard? I'm aware of
>>> log4j-mode, but couldn't find more. It's for java (logback and log4j)
>>> log files so I'd like to do fold stacktraces etc and also remove certain
>>> parts I'm not interested in to make the file smaller (we seem to log
>>> more useless than useful stuff…).

>> I see this library when I search for "log" on Emacs Wiki.
>> No idea how helpful it will be for you, however.
>> 
>> http://www.emacswiki.org/emacs/syslog-mode.el

> It is maintained at <https://github.com/vapniks/syslog-mode> and it's
> available on MELPA.

I got it from MELPA and put
 (require 'syslog-mode)
in the .emacs file.

But it doesn't open the log files in /var/log automatically, they still
open as Fundamental, and I have to 'M-x syslog-mode RET' to get the mode
running. 

The value of the syslog-log-file-directory variable is the default
"/var/log".  There doesn't seem to be any settings beyond that...?

Thanks!


- Steinar

Re: View log files with emacs

[John Mastro]

Steinar Bang <sb@dod.no> wrote:

> I got it from MELPA and put
>  (require 'syslog-mode)
> in the .emacs file.
>
> But it doesn't open the log files in /var/log automatically, they still
> open as Fundamental, and I have to 'M-x syslog-mode RET' to get the mode
> running.

I haven't used syslog-mode personally but, as a general matter,
something along these lines in your init file should do the trick:

(add-to-list 'auto-mode-alist '("\\`/var/log/" . syslog-mode))

-- 
john

Re: View log files with emacs

[Alex Kost]

Steinar Bang (2015-02-24 00:53 +0300) wrote:

> I got it from MELPA and put
>  (require 'syslog-mode)
> in the .emacs file.
>
> But it doesn't open the log files in /var/log automatically, they still
> open as Fundamental, and I have to 'M-x syslog-mode RET' to get the mode
> running. 
>
> The value of the syslog-log-file-directory variable is the default
> "/var/log".  There doesn't seem to be any settings beyond that...?

John Mastro answered this question (you need to adjust your
`auto-mode-alist').  I just wanted to tell that there is no need to add
(require 'syslog-mode) to your .emacs.  Syslog-mode will be
automatically loaded.

-- 
Alex

Re: View log files with emacs

[Filipp Gunbin]

On 17/02/2015 16:37 +0100, Eike wrote:

> Hello all,
>
> I have to look at some log files more often now and was wondering if
> there are some handy things for emacs in that regard? I'm aware of
> log4j-mode, but couldn't find more. It's for java (logback and log4j)
> log files so I'd like to do fold stacktraces etc and also remove certain
> parts I'm not interested in to make the file smaller (we seem to log
> more useless than useful stuff…).

Hi,

I'm not aware of special modes for e.g. java log files (although I do
read them very often), but there are certainly some handy general
things:

1) `auto-revert-tail-mode' - see its doc for the description.  Great for
looking at a growing log.  In fact, you don't need `less' or `tail -f'
with it any more.  See also `auto-revert-remote-files' variable.  You
might also want to set `auto-revert-verbose' to nil.

2) `vlf' package (View Large Files).  See its description.  Very
convenient for huge log files.  I use it quite rarely, though.

3) Combined with Tramp (and grep :) these provide enough functionality
for me.

Filipp

Re: View log files with emacs

[Eike]

Filipp Gunbin writes:

> On 17/02/2015 16:37 +0100, Eike wrote:
>
>> Hello all,
>>
>> I have to look at some log files more often now and was wondering if
>> there are some handy things for emacs in that regard? I'm aware of
>> log4j-mode, but couldn't find more. It's for java (logback and log4j)
>> log files so I'd like to do fold stacktraces etc and also remove certain
>> parts I'm not interested in to make the file smaller (we seem to log
>> more useless than useful stuff…).
>
> Hi,
>
> I'm not aware of special modes for e.g. java log files (although I do
> read them very often), but there are certainly some handy general
> things:
>
> 1) `auto-revert-tail-mode' - see its doc for the description.  Great for
> looking at a growing log.  In fact, you don't need `less' or `tail -f'
> with it any more.  See also `auto-revert-remote-files' variable.  You
> might also want to set `auto-revert-verbose' to nil.
>
> 2) `vlf' package (View Large Files).  See its description.  Very
> convenient for huge log files.  I use it quite rarely, though.
>
> 3) Combined with Tramp (and grep :) these provide enough functionality
> for me.
>
> Filipp

Hi Filipp,

these are very good points thanks a lot! I didn't know about the first
two, I'll look into it.

Regards,
Eike

--
gpg: AD7AC35E
finger print: 137F BB0B 1639 D25F DC5D  E59C B412 C5F5 AD7A C35E

Re: View log files with emacs

[Tassilo Horn]

Hi Eike,

many logging formats have a one-line-per-message format, and if there
are multi-line messages, the second-to-last lines are indented, e.g.,

[2015-02-18 08:22][foobar] An error occured: java.lang.NullPointerException
  some.Class.method()
  some.other.Class.method()
  ...

In that case you can use Selective Display for folding, see:

,----[ (info "(emacs)Selective Display") ]
| Emacs has the ability to hide lines indented more than a given number of
| columns.  You can use this to get an overview of a part of a program.
`----

And you can use `occur' for filtering to messages of a given type (as
long as you can encode that in a regex):

,----[ C-h f occur RET ]
| occur is an interactive compiled Lisp function in `replace.el'.
| 
| It is bound to M-s o.
| 
| (occur REGEXP &optional NLINES)
| 
| Show all lines in the current buffer containing a match for REGEXP.
| If a match spreads across multiple lines, all those lines are shown.
| 
| Each line is displayed with NLINES lines before and after, or -NLINES
| before if NLINES is negative.
| NLINES defaults to `list-matching-lines-default-context-lines'.
| Interactively it is the prefix arg.
| 
| The lines are shown in a buffer named `*Occur*'.
| It serves as a menu to find any of the occurrences in this buffer.
| C-h m in that buffer will explain how.
| 
| If REGEXP contains upper case characters (excluding those preceded by `\')
| and `search-upper-case' is non-nil, the matching is case-sensitive.
| 
| When NLINES is a string or when the function is called
| interactively with prefix argument without a number (`C-u' alone
| as prefix) the matching strings are collected into the `*Occur*'
| buffer by using NLINES as a replacement regexp.  NLINES may
| contain \& and \N which convention follows `replace-match'.
| For example, providing "defun\s +\(\S +\)" for REGEXP and
| "\1" for NLINES collects all the function names in a lisp
| program.  When there is no parenthesized subexpressions in REGEXP
| the entire match is collected.  In any case the searched buffer
| is not modified.
`----

And if the log files are still in use (grow bigger), then
`auto-revert-tail-mode' is your friend as Filipp already pointed out.

Bye,
Tassilo

Re: View log files with emacs

[Eike]

Hi Tassilo,

Thanks for your reply.

Tassilo Horn writes:

> Hi Eike,
>
> many logging formats have a one-line-per-message format, and if there
> are multi-line messages, the second-to-last lines are indented, e.g.,
>
> [2015-02-18 08:22][foobar] An error occured: java.lang.NullPointerException
>   some.Class.method()
>   some.other.Class.method()
>   ...
>
> In that case you can use Selective Display for folding, see:
>
> ,----[ (info "(emacs)Selective Display") ]
> | Emacs has the ability to hide lines indented more than a given number of
> | columns.  You can use this to get an overview of a part of a program.
> `----

Oh, that is great! Thank you.


> And you can use `occur' for filtering to messages of a given type (as
> long as you can encode that in a regex):

I found occur yesterday after searching the emacswiki (which Drew
reminded me of). That also is really nice! Together with `syslog-mode',
selective display and `auto-revert-tail-mode' it seems I have all I need
now. Emacs seems to have everything… :)

Kind regards,
Eike

--
gpg: AD7AC35E
finger print: 137F BB0B 1639 D25F DC5D  E59C B412 C5F5 AD7A C35E