Linux tip of the day

I am no Linux Nerd god, but I do a bit and come across a really useful tit bit.

Here is one.

Lots of things on Linux (or UNIX) get logged in log files. If something is going wrong it can be useful to look at the log files, that's what they are for. The problem with these log files is they can be big and you may be looking for a needle in a haystack.

However there are tools to help. Here are the ones I use most.

Tail. If you tail a file it shows you the end of the file. Like for example:

tail /var/log/mail

will show the end of the mail log file (assuming that /var/log/mail is your mail log file).

tail -f /var/log/mail

will show you the end of the log file, but will also show you any new bits as they are added. Very handy. So you tail -f the log file, then replicate the fault and the answer pops up on the screen.

Some times though, tailing a log file is hard work as on a busy mail server stuff is flying up the screen at a rate of notts.

That's where grep comes in. You use grep to show you a line in a file which contains a given expression. For example:

grep me@somedomain.com /var/log/mail

will give you every line of the log file that has me@somedomain.com in it. Fantastic.

One of the great things though about the Linux command line is that you can get one command line program to pass its output to another to do something else with it to produce a more refined out put. So how do we find something useful that is about to happen in a log file that is growing quickly?

Here's how:

tail -f /var/log/mail | grep me@somedomain.com

That will show any new lines in the log file that contains the email address.

Of course you need not be looking at a mail log file or for an email address. If you use fetchmail and only want to see what fetchmail is doing rather than the rest of the mail system you would type:

tail -f /var/log/mail | grep fetchmail

(fetchmail normally puts "fetchmail" in any entries it makes in a log file.)

grep can also return lines before and after the line you were looking for. Use -A num for after occurrence and -B num for before.

You can also man grep to get the full manual page, or for an easier on the eye read you can also type man grep into google and read man pages on line.

The "|" is the symbol for pipe. On a UK keyboard you will find it on the bottom left hand side, and will need to press shift to get to it. What it means is pipe the output of this program to that over there. Works very well.