查看 Unix 日志文件
我们在工作中正在讨论，查看日志文件最好的UNIX命令工具是什么。一方说少用，另一方说多用。一个比另一个更好吗？
We are having a discussion at work, what is the best UNIX command tool that to view log files. One side says use LESS, the other says use MORE. Is one better than the other?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（9）
一个常见的问题是日志有太多进程写入日志，我更喜欢使用以下命令过滤日志文件并控制输出：
tail -f /var/log/| grep <一些标识符> |更多 这个命令组合允许您查看活动日志文件，而不会被输出淹没。
A common problem is that logs have too many processes writing to them, I prefer to filter my log files and control the output using:
tail -f /var/log/<some logfile> | grep <some identifier> | moreThis combination of commands allows you to watch an active log file without getting overwhelmed by the output.
我选择少一点。这样做的原因是（在 lessopen 的帮助下）它可以读取 gzipped 日志（由 logrotate 存档）。
作为这个单一命令的示例，我可以以时间顺序模式读取 dpkg 日志，而无需处理不同的 gzip 压缩日志：
I opt for less. A reason for this is that (with aid of lessopen) it can read gzipped log (as archived by logrotate).
As an example with this single command I can read in time ordered mode dpkg log, without treating differently gzipped ones:
Multitail 是最好的选择，因为您可以同时查看多个日志。它还可以为内容着色，并且您可以设置正则表达式来突出显示您要查找的条目。
Multitail is the best option, because you can view multiple logs at the same time. It also colors stuff, and you can set up regex to highlight entries you're looking for.
您可以使用任何程序：less、nano、vi、tail、cat 等，它们的功能有所不同。
还有许多日志查看器：gnome-system-log、kiwi 等（它们可以按日期/类型等对日志进行排序）
You can use any program: less, nano, vi, tail, cat etc, they differ in functionality.
There are also many log viewers: gnome-system-log, kiwi etc (they can sort log by date / type etc)
少即是多。尽管当我查看日志时，我通常会搜索特定的内容或只是对最后几个事件感兴趣，但我发现自己使用的是 cat、pipes 和 grep 或 tail，而不是或多或少。
Less is more. Although since when I'm looking at my logs I'm typically searching for something specific or just interested in the last few events I find myself using cat, pipes and grep or tail rather than more or less.
少就是最好，我认为。与编辑器相比，它的重量很轻，它允许向前和向后导航，它具有强大的搜索功能，等等。按“h”寻求帮助。花时间熟悉它是非常值得的。
less is the best, imo. It is light weight compared to an editor, it allows forward and backward navigation, it has powerful search capabilities, and many more things. Hit 'h' for help. It's well worth the time getting familiar with it.
在我的 Mac 上，使用标准终端窗口，
less和more之间有一个区别，即退出后：less不会给我留下太多混乱。 screenmore在我的屏幕上留下更多有用的信息因此，如果我认为我可能想在查看器完成后对正在查看的材料执行某些操作（例如，复制和粘贴操作），我使用
更多；如果我不想在完成后使用该材料，那么我会少用。less的主要优点是能够向后滚动；因此，我倾向于使用less而不是more，但两者对我都有用处。 YMMV（YMWV；在本例中W = 意志！）。On my Mac, using the standard terminal windows, there's one difference between
lessandmore, namely, after exiting:lessleaves less mess on my screenmoreleaves more useful information on my screenConsequently, if I think I might want to do something with the material I'm viewing after the viewer finishes (for example, copy'n'paste operations), I use
more; if I don't want to use the material after I've finished, then I useless.The primary advantage of
lessis the ability to scroll backwards; therefore, I tend to uselessrather thanmore, but both have uses for me. YMMV (YMWV; W = Will in this case!).由于您的问题一般是关于“Unix 系统”，因此请考虑到这一点
在某些情况下你别无选择，对于旧系统你只有更多可用，
但也不少。
LESS是GNU工具的一部分，MORE来自UCB时代。
As your question was generically about 'Unix systems', keep into account that
in some cases you have no choice, for old systems you have only MORE available,
but not LESS.
LESS is part of the GNU tools, MORE comes from the UCB times.
打开
grep的行缓冲模式。使用tail（实时监控）
使用less（实时监控）
使用 tail & grep
使用 less & grep
使用 watch &尾部突出显示新行
<块引用>
注意：适用于 Linux 系统。
Turn on
grep's line buffering mode.Using tail (Live monitoring)
Using less (Live monitoring)
Using tail & grep
Using less & grep
Using watch & tail to highlight new lines