Entry submitted by arno. DPOTD needs your help, please contribute !
To cope with different kind of logs, ccze uses different plugins, each able to understand one type of file. Currently, ccze support 19 different plugins, such as exim, httpd, procmail, and much more. If a line is recognized by no plugin, a default parsing and coloration are available. You can also add support for a new type of file, by creating a plugin and copying it in /usr/lib/ccze, or $HOME/.ccze.
By default, ccze uses ncurses for output, but you can also display on standard output, or to format a report in html. Czze is based on colorizer, an older log coloriser. Actually, ccze was a rewrite in C language to make it faster (coloriser was written in perl language).
Other log colorizer in Debian and Ubuntu include lwatch and loco. Loco is a nice tool, but only uses a generic parser. Therefore, output is sometimes less accurate than ccze. With lwatch, you can define your regexps in a configuration file. So, it’s more easy to add a new type of file. Lwatch reads data from named fifo, so it is not really suitable for use from the command line.
- System administrators.
- Users that watch their log regularly, and/or need to get a quick grasp of what’s going on their system.
Loganalysis.Org has online bibliography on logging and related topics. You can consult it at http://www.loganalysis.org/frames/left-navbar-library.html
Latest ccze release is available in both Debian and Ubuntu.