Try out multitail. This is an übergeneralization of tail -f. You can watch multiple files in separate windows, highlight lines based on their content, and more.
multitail -c /path/to/log
The colors are configurable. If the default color scheme doesn't work for you, write your own in the config file. For example, call multitail -cS amir_log /path/to/log with the following ~/.multitailrc:
colorscheme:amir_log
cs_re:green:INFO
cs_re:red:SEVERE
Another solution, if you're on a server where it's inconvenient to install non-standard tools, is to combine tail -f with sed or awk to add color selection control sequences. This requires tail -f to flush its standard output without delay even when its standard output is a pipe, I don't know if all implementations do this.
tail -f /path/to/log | awk '
/INFO/ {print "\033[32m" $0 "\033[39m"}
/SEVERE/ {print "\033[31m" $0 "\033[39m"}
'
or with sed
tail -f /path/to/log | sed --unbuffered \
-e 's/\(.*INFO.*\)/\o033[32m\1\o033[39m/' \
-e 's/\(.*SEVERE.*\)/\o033[31m\1\o033[39m/'
If your sed isn't GNU sed, replace \o033 by a literal escape character and remove --unbuffered.
Yet another possibility is to run tail -f in an Emacs shell buffer and use Emacs's syntax coloring abilities.
From the tail(1) man page:
With --follow (-f), tail defaults to following the file descriptor,
which means that even if a tail’ed file is renamed, tail will continue
to track its end. This default behavior is not desirable when you
really want to track the actual name of the file, not the file descrip-
tor (e.g., log rotation). Use --follow=name in that case. That causes
tail to track the named file in a way that accommodates renaming,
removal and creation.
Your text editor is renaming or deleting the original file and saving the new file under the same filename. Use -F instead.
Best Answer
Instead of printing matching lines with decorations, decorate matching lines, and print everything:
This
awkprogram consists of three patterns and associated actions:User@Host:are processed with$0 = "\033[32m" $0 "\033[39m", which surrounds the current line with the given escape codes;Query_time:are processed with$0 = "\033[29m" $0 "\033[39m";1is non-zero (so all lines) are processed with the default action, which is to print the current line.These are cumulative: all actions whose patterns match the current line are executed, in the order in which they are defined. A line matching
User@Host:is modified (first action) and printed (third action). A line matchingQuery_time:is modified (second action) and printed (third action). A line matching neither is printed (third action).That's the simplest technique to print all lines, without having to keep track of whether a line has been processed yet (to avoid printing a line twice). Instead of printing something in every set of action statements, we modify the current line as appropriate, and only print it once (but always print it).