MTail is a portable program for 32-bit and 64-bit editions of the Windows operating system. You can run it from any location once you have unpacked the main executable.

You can use the file browser to load a text document from the system, or specify file names with wildcards, which is handy if the file names change regularly. This is often the case if a maximum file size for a log has been configured on the system. The last logical file name is always selected and the program checks the directory for newer files that match the string on every update.

MTail monitors the selected file or path constantly right from the start. You can press the Stop button to stop the monitoring, and start again to continue it.

The filter option in the main interface can be used to display only lines containing the selected string. A click on Filter inverts the selection, so that only lines that do not contain the string are shown in the program window.

Alerts can be activated here as well. There are two types of alerts. One if the monitored text file is updated, and one if a user specified text is found in the document. The notifications are configured in the program settings. Available for selection are sound and email notifications. SMTP settings need to be entered under the General tab in the configuration if email notifications are selected.

There is also an alerts window that displays all lines of text that have triggered an alert. The window is updated regularly as well.

Alerts and filters can be entered as plain text, or as regular expressions.

Additional program options are displayed in the main menu. Here it is possible to change the read buffer, offsets, word wrap IP look-ups which is handy for server log files. About the read buffer. It is set to 50 which means that you will not see all the lines of larger files. You can easily increase the number to display additional lines of the document.

The program can be used from the command line as well, for example to process a log in a batch file.

MTail is an excellent text filtering and monitoring application. It offers a rich feature set coupled with Unicode support and the ability to load text files of nearly any size, thanks to its intelligent read buffering and offset configuration options. (I tried various file sizes up to 1.2 Gigabytes and the files displayed almost instantly every time).

System administrators, webmasters, tech support and tech savvy users should have the portable program in their tools collection.

I suggest you consult the comprehensive MTail help document if you run into troubles or difficulties while using the software. You can download MTail from the developer website. The program is compatible with 32-bit and 64-bit editions of the Windows operating system starting with Windows 2000 all the way up to Windows 7. (via)

Multitail does exactly as it sounds – it allows more than one instance of the tail command in a single window. Given that we should probably take a look at the tail command first.

Tail

What tail does is print the output of a log file in real time. With this you can open up, say, /var/log/messages with tail and see the last ten lines of that file as they are printed.  This comes in very handy when you need to see the errors precisely as they happen.

To run the tail command on a log file (we’ll stick with our example above) you would issue the command:

tail -f /var/log/messages

You would see printed the last ten kernel buffer messages as they are added. This is very helfpul when you are plugging in a USB device and you want to find out what address the device is attached to.

But what if you want to view, say, /var/log/mail.err and /var/log/mail.warn together? Sure you could open up two terminals and issue the tail commands for each log file, but why do that when you can have them in the same window?

Getting and installing multitail

The easiest way to install multitail is to issue the command (since you’ll be working in the command line anyway):

sudo apt-get install multitail

or

yum install multitail

Once the application is installed you are ready to go (there is no configuration necessary).

Running multitail

The structure of the multitail command is:

multitail -i FIRSTLOG -i SECONDLOG

Where FIRSTLOG and SECONDLOG are the log files you want to follow. Sticking with the example above let’s follow mail.err and mail.info. We do this with the command:

sudo multitail -i /var/log/mail.err -i /var/log/mail.info

Figure 1

The above command will have multitail following both log files horizontally (as shown in Figure 1). At first it can be a bit disconcerting to see and follow. What you are seeing is the /var/log/mail.err file being tail’d on top and the /var/log/mail.info file being tail’d on bottom. The easiest way to discern one from the other is at the bottom of each tail is the white bar showing what file is being tail’d.

If you do not like the horizontal layout you can change that to a vertical layout with the s switch like so:

sudo multitail -s 2 -i /var/log/mail.err -i /var/log/mail.info

Figure 2

When you run this version of the command the tail’s are side by side with a wide vertical bar between them (as you can see in Figure 2).

Merging logs

You can also use multitail to merge multiple logs into one log. This can help you when you know you need to follow the output of more than one log file but you don’t need them separated. To do this you use the mergeall option like so:

sudo multitail –mergeall -i /var/log/mail.err -i /var/log/mail.info

Final thoughts

Multitail is one of those tools that once you get used to having it in your toolkit you will pull it out again and again.

dmesg

When I have a problem (or when I am attaching a usb device) one of the first places I go is the dmesg command. The dmesg command prints out the kernel keyring buffer. The information you will get will be all of the information you do not see when your system is booting. This is a great place to get information (low level) on your hardware. On one of my laptops, I run dmesg and near the top I see:

Phoenix BIOS detected: BIOS may corrupt low RAM, working it around.
last_pfn = 0x7f6d0 max_arch_pfn = 0x100000
x86 PAT enabled: cpu 0, old 0x7040600070406, new 0x7010600070106
kernel direct mapping tables up to 38000000 @ 10000-15000
Using x86 segment limits to approximate NX protection
RAMDISK: 37c6a000 - 37fef4a2


From that I can tell I have a Phoenix bios. Pretty obvious. A little later I see:

Security Framework initialized
SELinux:  Initializing.
SELinux:  Starting in permissive mode

Now I know Security Enhanced Linux is starting, in permissive mode, at bootup. And even further on down the line I see:

CPU1: Intel(R) Pentium(R) Dual  CPU  T2390  @ 1.86GHz stepping 0d
checking TSC synchronization [CPU#0 -> CPU#1]: passed.
Brought up 2 CPUs
Total of 2 processors activated (7447.76 BogoMIPS)

The above shows me information about my CPU. Good to know.

The most important information you will probably get from dmesg is the information regarding attached USB devices. When you plug in a USB device you will need to know what special device this is attached to so you can mount it. This will occur at the bottom of the dmesg command output.

The output of dmesg is quite long and will scroll by very quickly. When I run this command I always pipe it through the less command like so:

dmesg | less

This way I can view the output one page at a time.

/var/log

This special directory is the Mac Daddy of information gathering. Fire up a terminal window and issue the command ls /var/log/ and see what it contains. You see, included in this listing, such log files and log directories as:

• boot.log – boot information
• cron – cron logs
• cups – directory of all printing logs
• httpd – Apache logs
• mail – Mail server logs
• maillog – The mail log
• messages – Post-boot kernel information
• secure – Security log
• Xorg.0.log – X Server log

You can see the listing of log files in the /var/log directory, but in order to actually read the log files you have to be the root user (or use sudo).

Viewing with tail

One of the handiest methods of viewing log files is using the tail command. What tail does is follow the running output of a log file. For instance if I want to follow my /var/log/secure log to watch for security issues I would enter the command tail -f /var/log/secure. The f switch tells tail to follow. If  you don’t add the f switch tail will just list the output all at once (as if you just issued less /var/log/secure.)

Final Thougths

There is so much information to be gained from reading log files. The Linux operating system makes reading log files easy, once you know which log file does what. Take a poke around /var/log to find out exactly what you have and where you need to look for the problem you are having.