Examples

• Merge 2 logfiles in one window:

  multitail /var/log/apache/access.log -I /var/log/apache/error.log
  

• Show 3 logfiles in 2 columns:

  multitail -s 2 /var/log/apache/access.log /var/log/messages /var/log/mail.log
  

• Show 5 logfiles while merging 2 and put them in 2 columns with only one in the left column:

  multitail -s 2 -sn 1,3  /var/log/apache/access.log -I /var/log/apache/error.log /var/log/messages \
                          /var/log/mail.log /var/log/syslog
  

• Merge the output of 2 ping commands while removing "64 bytes received from" from only 1 of them:

  multitail -l "ping 192.168.0.1" -ke "64 bytes from" -L "ping 192.168.0.2"
  

• Show the output of a ping-command and if it displays a timeout, send a message to all users
  currently logged in

  multitail -ex timeout "echo timeout | wall" -l "ping 192.168.0.1"
  

• In one window show all new TCP connections and their state changes using netstat while in
  the other window displaying the merged access and error logfiles of apache

  multitail -R 2 -l "netstat -t" /var/log/apache/access.log -I /var/log/apache/error.log
  

• As the previosu example but also copy the output to the file netstat.log

  multitail -a netstat.log -R 2 -l "netstat -t tcp" /var/log/apache/access.log -I /var/log/apache/error.log
  

• Show 2 logfiles merged in one window but give each logfile a different color so that you
  can easily see what lines are for what logfile:

  multitail -ci green /var/log/apache/access.log -ci red -I /var/log/apache/error.log
  

• Show 3 rssfeeds merged in one window using rsstail

  multitail -cS rsstail -l "rsstail -n 1 -z -l -d -u http://setiathome.berkeley.edu/rss_main.php" \
  	-cS rsstail -L "rsstail -n 1 -z -l -d -u http://www.biglumber.com/index.rss" -cS rsstail \
  	-L "rsstail -n 1 -z -l -u http://kernel.org/kdist/rss.xml"
  

• Show a Squid (proxy server) logfile while converting timestamps to something readable

  multitail -cv squid /var/log/squid/access.log
  

• Display Q-Mail logging while converting the timestamp into human readable format

  multitail -cv qmailtimestr /var/log/qmail/qmail.smtpd.log
  

• Merge ALL apache logfiles (*access_log/*error_log) into one window:

  multitail -cS apache --mergeall /var/log/apache/*access_log --no-mergeall -cS apache_error \
  	--mergeall /var/log/apache/*error_log --no-mergeall
  

• Monitor the logfile of an other system:
  For this you need to setup a couple of things. MultiTail runs on system A, the logfile on system B.
  In this example we're going to monitor the apache logfile. Add the following to /etc/services:

  apachelog       20000/tcp
  

  Add this to /etc/inetd.conf:

  apachelog stream tcp nowait root /usr/local/sbin/tail_apache_log /usr/local/sbin/tail_apache_log
  

  and create the file /usr/local/sbin/tail_apache_log with the following content:

  #!/bin/sh
  
  /usr/bin/tail -f /var/log/apache2/access.log
  

  make sure that you don't forget to make that script executable (chmod +x filename).
  Then on host A start MultiTail like this:

  multitail -cS apache -l "telnet B 20000"
  

  Please note that logfiles go in plaintext across the network. You may also need to adjust
  the files /etc/hosts.[allow|deny] on host B to only allow host A to connect.
  
• Monitoring Tomcat

  multitail -cS apache -cS log4j "${TOMCAT_HOME}/logs/catalina.out"
  

  
  

  Examples on the web

  2 cent tip in Linux Gazette
  
  Using MultiTail as an IRC client!