Stop using tail -f (mostly) • Hacker News Board

Re: Stop using tail -f (mostly)

#21

Post by evincarofautumn » Mon, Mar 30, 2015, 4:46 PM UTC

pimlottc wrote: post #15

I was introduced to less +F a while ago and it is quite nice, but there is one simple "feature" of tail -f that I miss quite a lot: being able 'mark' the log with gaps by hitting enter a few times. This is especially handy when you have to first load a page or warm up the app before performing the operation you're interested in watching, letting you separate the earlier output from the lines generated by what you're…

With less, you can use m to mark the current position and ' to go to a marked position. h will show you lots of useful help.

Re: Stop using tail -f (mostly)

#22

Post by nilkn » Mon, Mar 30, 2015, 4:47 PM UTC

gitaarik wrote: post #20

It's a nice feature of less, but less is a pager, so you can't pipe the result to `grep` or `sed` or `awk` or something.

I'd wager that 90% of the time that I'm using 'tail -F' I'm also piping it to grep.

Re: Stop using tail -f (mostly)

#23

Post by jabo » Mon, Mar 30, 2015, 4:47 PM UTC

varikin wrote: post #10

jabo wrote: post #5

I use tail -f and when I need to search, I use iTerm's search (Cmd+F) which highlights matches and even supports regex. I also have an unlimited scroll buffer so I can just scroll up or down to get the context of a particular match.

That only works if you only care about search results since you started tailing. If you want to search for what happened before you started tailing, you need to stop tailing and use less/grep/etc.

Ah yes. I usually let the tail -f run, open another SSH session and grep from there.

Re: Stop using tail -f (mostly)

#24

Post by pcwalton » Mon, Mar 30, 2015, 4:48 PM UTC

less is my favorite text editor. It's a pity it doesn't actually edit text.

Re: Stop using tail -f (mostly)

#25

Post by orthecreedence » Mon, Mar 30, 2015, 4:50 PM UTC

I use tail -f with tmux usually. Will less +F save the entire output into memory? In other words, if I accidentally leave it open in a tmux shell and the log grows to 300mb of output, will the server start swapping?

Re: Stop using tail -f (mostly)

#26

Post by mrinterweb » Mon, Mar 30, 2015, 4:51 PM UTC

One advantage that tail -f has is that you can insert newlines or other characters into the output to help you visually split log entries. Log files often look the same so being able to visually split up the log is very helpful IMO.

Re: Stop using tail -f (mostly)

#27

Post by spatz » Mon, Mar 30, 2015, 4:53 PM UTC

The problem is that less +F polls every second while tail -f uses inotify, which is both more efficient and responds faster to change.

Re: Stop using tail -f (mostly)

#28

Post by jimktrains2 » Mon, Mar 30, 2015, 4:54 PM UTC

evincarofautumn wrote: post #21

pimlottc wrote: post #15

I was introduced to less +F a while ago and it is quite nice, but there is one simple "feature" of tail -f that I miss quite a lot: being able 'mark' the log with gaps by hitting enter a few times. This is especially handy when you have to first load a page or warm up the app before performing the operation you're interested in watching, letting you separate the earlier output from the lines generated by what you're…

With less, you can use m to mark the current position and ' to go to a marked position. h will show you lots of useful help.

GP isn't meaning it like that, they mean being able to add some spaces so that the next log entries stand out for quick visual identification as you're making changes and reloading the application.

Re: Stop using tail -f (mostly)

#29

Post by karlgoldstein » Mon, Mar 30, 2015, 4:54 PM UTC

Or just tail -f in an emacs buffer

Re: Stop using tail -f (mostly)

#30

Post by 0x0 » Mon, Mar 30, 2015, 4:55 PM UTC

drzaiusapelord wrote: post #13

tikums wrote: post #6

Or use multitail. It supports syntax highlighting, among other features: http://www.vanheusden.com/multitail/

multitail is great. I really cannot use command line utils that don't support colors/highlighting anymore. htop instead of top, etc. It just gives me much better visibility and readability. I'm surprised that so many non-color utils are still being used. It just feels so 1994 to me to stare at a white on black display. I guess there's nothing more slow moving and conservative than shell interfaces, thus articles like…

Also take a look at ccze which is great for syntax-coloring all kinds of log files heuristically.

For example: tail -F somefile.log|ccze -A

For your shell, there's a lot of funky colorful interactive customizations you can get on zsh and fishfish.