Monitoring Live Log Updates with Tail

The tail command is primarily used with the -f flag to monitor a file in real-time as new data is appended.

 -f, --follow[={name|descriptor}]
                           Continuously display new output as the file grows.
                           Without an argument, it defaults to 'descriptor'.

Example usage to monitor the last 1000 lines of a log file:

tail -1000f application.log

Pressing Enter inserts a blank line for readability, while Ctrl+C terminates the monitoring session.

Searching Within Logs Using Vi/Vim

Open a log file directly in the editor:

vim server.log

After opening the file:

• Press / followed by a search term to search forward from the cursor.
• Press ? followed by a search term to search backward from the cursor.
• Press Enter to execute the search.
• Use n to jump to the next match.
• Use h, j, k, l to navigate within the file.

Filtering Log Content with Grep

grep is a versatile tool for searching text. A common use is displaying context around matches.

grep -C 15 "ERROR" web.log

The -C option shows the 15 lines preceding and following each match.

Context example:

$ grep -C 1 item_id transaction.log
order_id: 45
item_id: 89123
quantity: 2
---
user: alice
item_id: 45678
status: shipped

To include line numbers in the output:

grep -C 5 -n "connection refused" app.log

Recursively Searching Directory Structures

Search all files within a directory and its subdirectories.

grep -rHn "TimeoutException" /var/log/

Options explained:

• -r: Perform a recursive search.
• -H: Print the filename for each match.
• -n: Print the line number for each match. Omitting the directory searches the current working directory.

Example output:

$ grep -rHn "LoginFailed" .
./auth.log:112:LoginFailed for user 'jdoe'
./archive/auth_old.log:45:LoginFailed for user 'admin'

Chaining Grep Commands with Pipes

Pipeline the output of one grep command into another for more refined filtering.

grep "CRITICAL" system.log | grep -C 3 "disk full"

This command first finds lines containing "CRITICAL", then filters those results for lines containing "disk full", showing 3 lines of context.

Escaping Special Characters in Searches

When a search pattern contains special characters like quotes or brackets, escape them with a backslash (\).

grep -rHn -C 2 \"user_profile\"

This searches for the literal string "user_profile" (including the double quotes) and shows two lines of context.