begin quoting Alan as of Tue, May 01, 2007 at 02:03:34PM -0700: > I frequently need to compare two syslog type files from different machines. > > I'm in search of a solution to help me do this. > Ideally, I'd like to be able to intersperse the two files into one display > with color coding. > Something like: > *Blue* 2007/05/01 07:38:46 System 1 event. > *Red* 2007/05/01 07:39:23 System 2 event. > *Blue* 2007/05/01 07:45:18 System 1 event. > *Blue* 2007/05/01 07:48:58 System 1 event. > *Red* 2007/05/01 07:56:38 System 2 event. > > I don't really need the changes between them ala diff, I need to be able > to see them both at the same time. Side by side display would be ok, as > long as the timestamps could be reasonably matched up.
At a first stab, off the top of my head: % cut -d' ' -f1-3 logfile1 > timestamps1 % cut -d' ' -f1-3 logfile2 > timestamps2 % cat logfile1 timestamps1 timestamps2 | sort > compare1 % cat logfile2 timestamps1 timestamps2 | sort > compare2 % vimdiff compare1 compare2 (Or gvimdiff, as that's easier to resize and already has colors.) > A bonus would be if the program could "adjust" the timestamps for those > systems whose clocks are not in sync. Hm. How would the program know? -- Feed it an offset by hand? Stewart Stremler -- [email protected] http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list
