Free log file software for linux

klogview is a KDE real-time log file viewer, like tail -f. The main window contains any number of dockable log panels, with an arbitrary number of log sources in each of them.
Every log source can have a separate font color and style. Other features include filters, alerts, different encodings, and tray support.
Main features:
- Any number of dockable log panels
- Any number of log sources per log panel
- "File" log source
- "Process output" log source
- Configurable fonts and colors
- Filters and alerts
- Tray icon
Enhancements:
- Removed forced autoscroll
- Ability to reopen log files
- Ability to enable/disable log sources stop filter flag

HTTPD::Log::Filter is a Perl module to filter entries out of an httpd log.

SYNOPSIS

my $hlf = HTTPD::Log::Filter->new(
exclusions_file => $exclusions_file,
agent_re => .*Mozilla.*,
format => ELF,
);

while( )
{
my $ret = $hlf->filter( $_ );
die "Error at line $.: invalid log formatn" unless defined $ret;
print $_ if $ret;
}

print grep { $hlf->filter( $_ ) } ;

$hlf = HTTPD::Log::Filter->new(
capture => [ qw(
host
ident
authexclude
date
request
status
bytes
) ];
);

while( )
{
next unless $hlf->filter( $_ );
print $hlf->host, "n";
}

print grep { $hlf->filter( $_ ) } ;

This module provide a simple interface to filter entries out of an httpd logfile. The constructor can be passed regular expressions to match against particular fields on the logfile. It does its filtering line by line, using a filter method that takes a line of a logfile as input, and returns true if it matches, and false if it doesnt.

There are two possible non-matching (false) conditions; one is where the line is a valid httpd logfile entry, but just doesnt happen to match the filter (where "" is returned). The other is where it is an invalid entry according to the format specified in the constructor.

Libflog is a simple file based event logger. libflog is customizable and easy to integrate with any C or C++ application. The library allows an application to define an unlimited number of log streams, each with its own time satmping and prefix settings.

Each log stream can be directed to a different file, or it can be redirected to standard console output (stdout, stderr). The library supports transparent log file compression, provided you have a shared version of zlib installed on your system: all you have to do is append a ".gz" suffix to the log file name.

Writing to a log stream is as easy as using the printf function. The library hides duplicated messages, replacing them with the repeat count. It is thread safe and includes the code for serializing calls from different threads, you dont need to care about it.

The library is developed as an attempt to minimize code replication and centralize bug tracking for a number of projects that Im working on. If someone is willing to use the library, they may do so.

Wflogs is a firewall log analysis tool. It can be used to produce a log summary report in plain text, HTML and XML, or to monitor firewalling logs in real-time.
This project is part of the WallFire project, but can be used independently.
Usage examples:
wflogs -i netfilter -o html netfilter.log > logs.html
converts the given netfilter log file into a HTML report.
wflogs --sort=protocol,-time -i netfilter -o text netfilter.log > logs.txt
converts the given netfilter log file into a sorted (by protocol number, then reverse time) text report.
wflogs -f $start_time >= [this 3 days ago] && $start_time < [this 2 days ago] && $chainlabel =~ /(DROP|REJECT)/ && $sipaddr == 10.0.0.0/8 && $protocol == tcp && ($dport == ssh || $dport == telnet) && ($tcpflags & SYN) -i netfilter -o text --summary=no
shows log entries (without summary) which match the given expression (refused connection attempts that occured 3 days ago to ssh and telnet ports coming from internal network 10.0.0.0/8).
wflogs -i netfilter -o text --resolve=0 --whois=0 netfilter.log
converts the given netfilter log file into a text report (default mode), disabling IP address reverse lookups and whois lookups.
wflogs -i netfilter -o xml netfilter.log > logs.xml
exports netfilter logs in XML.
wflogs -i ipchains -o netfilter ipchains.log > netfilter.log
converts ipchains logs into netfilter log format. So you may process them with your favorite netfilter log analyser, for example (even if the latter may not be better than wflogs itself.
wflogs -i ipfilter -o human --datalen=yes ipfilter.log
produces a report about ipfilter logfile in natural language on stdout, displaying packet length (datalen option) which is not showed by default.
wflogs -R -I
monitors logs in real-time in an interactive shell, waiting for logs in the default system logfile, in guessed format (according to the local firewalling tool).
Supported systems
WallFire is intended to work on real systems such as Unix, especially Linux and *BSD.
Current wflogs input modules are:
- netfilter (Linux 2.4 and 2.6 firewall logs)
- ipchains (Linux 2.2 firewall logs)
- ipfilter (NetBSD, FreeBSD, OpenBSD, Solaris, SunOS 4, IRIX and HP-UX running ipfilter firewall logs).
- cisco_pix (Cisco PIX filter logs)
- cisco_ios (Cisco IOS filter logs)
- snort (Snort ACLs logs)
Please note that input modules are available on any architecture on which wflogs can run (for example, you can perfectly parse Cisco PIX logs on a Linux box).
Enhancements:
- Improved matching of netfilter and ipfilter input modules.
- Added support for Cisco FWSM (PIX).
- Improved netfilter parsing.
- Compilation fixes for *BSD.
- Added wflogs.dtd.
- Added wfchkintegrity tool, which enables to monitor changes in the firewalling configuration.
- Fixed buffer sizes for some input modules.
- Fixed parsing with recent flex versions.

NewSyslog is a highly configurable program for managing and archiving log files.
Main features:
- It is more portable (using GNU Autoconf) and it can be compiled and installed on most any modern Unix or Unix-like system.
- It has support for fixed time-of-day daily archiving with a command-line option to identify the daily roll-over invocation (which may be at midnight, or at any other regular daily time).
- It supports the FreeBSD feature that allows specification of the log roll-over time as a daily, weekly, or monthly interval (with optional time-of-day specification for the last two). [The other overly flexible, ISO 8601 interpretation of the interval "@" option is not supported -- it is too generic and not meaningful enough in the context of log file management.]
- It supports optional PID files so that non-standard daemons can be told to re-open their logfiles after archiving has taken place. (Including /dev/null which disables signalling of any daemon when the specified log file is rolled over.)
- It can send a signal other than SIGHUP to the daemon associated with a given log file.
- It can leave the most recently archived log file uncompressed, which is necessary for daemons like httpd and smail because they continue to write to the current log file until their current jobs have completed. (This also makes it much easier to review recent log data with normal Unix tools.) [NetBSD now has this feature.]
- It supports the FreeBSD feature of being able to restrict processing to just those log files specified on the command line.
- Unlike the NetBSD version it first parses the config file before taking any action, meaning that if any errors are encountered it will report them and quit without doing anything.
- Unlike the FreeBSD version, it will roll a log file if either the interval or size limits have been reached (FreeBSDs version makes it too easy to have a rapidly growing log file overflow the filesystem).
- Unlike the NetBSD version it always creates any missing log file (though this can be disabled on a per-file basis).
- It uses an advisory lock on the current configuration file to prevent multiple invocations from tripping over each other.
- The documentation is far better!

Log::Localized is a Perl module to localize your logging.

SYNOPSIS

What you most probably want to do is something like:
package Foo;
use Log::Localized;

sub bar {
# this message will be displayed if method bars verbosity is >= 1
llog(1,"running bar()");
}

# this message will be displayed if package Foos verbosity is >= 3
llog(3,"loaded package Foo");
Then paste the following local verbosity rules in a file called verbosity.conf, in the same directory as your program:
# log everything from wherever inside Foo and its subclasses, up to level 3
Foo:: = 3
# except for function Foo::foo who shall have verbosity 0
Foo::bar = 0

SYNOPSIS - ADVANCED

In a program accepting command line arguments, you may want to do:
use Getopt::Long;
use Log::Localized log => 1;

GetOptions("verbose|v+" => sub { $Log::Localized::VERBOSITY++; } );

llog(1,"you used -v");
llog(2,"you used -v -v");
You may alter local verbosity from within the running code:
package Foo;
use Log::Localized log => 1;

# verbosity level is 0 by default

{
# set verbosity locally in this block
local $Log::Debug::VERBOSITY = 5;
llog(5,"this will be logged");
}

debug(5,"but this wont");
If you want to import llog under another name in the calling module:
package Foo;
use Log::Localized rename => "my_log";

# call Log::Localized::llog()
my_log(1,"renamed llog()");
See the examples directory in the module distribution for more real life examples.

Log::Localized provides you with an interface for defining dynamically exactly which part of your code should log messages and with which verbosity.

Log::Localized addresses one issue of traditional logging: in very large systems, a slight increase in logging verbosity usually generates insane amounts of logs. Hence the need of being able to turn on verbosity selectively in some areas of code only, in a localized way.

Log::Localized is based on the concept of local verbosity. Each package and each function in a package has its own local verbosity, set to 0 by default. With Log::Localized you can change the local verbosity in just a function, just a package or just a class hierarchy via a so called verbosity rule. Verbosity rules are passed to Log::Localized either via a configuration file or via an import parameter. By changing verbosity rules according to the needs of the moment, you can alter your programs logging flow in a very fine-grained way, and get logs from only the code areas you are interested in.

Log::Localized comes with default settings that make it usable out of the box, but its configuration options will let you redefine pretty much everything in its behavior.
The actual logging in Log::Localized is handled by Log::Dispatch.