1MERGELOGS(1)                General Commands Manual               MERGELOGS(1)
2
3
4

NAME

6       mergelogs - merge and consolidate web server logs
7
8

SYNOPSIS

10       mergelogs -p penlog [-c] [-d] [-j jitter] [-t seconds] server1:logfile1
11       [server2:logfile2 ...]
12
13

EXAMPLES

15       mergelogs -p pen.log 10.0.0.1:access_log.1 10.0.0.2:access_log.2
16
17       mergelogs       -p        pen.log        10.0.18.6:access_log-10.0.18.6
18       10.0.18.8:access_log-10.0.18.8
19
20

DESCRIPTION

22       When  pen  is used to load balance web servers, the web server log file
23       lists all accesses as coming from the host running pen. This  makes  it
24       more difficult to analyze the log file.
25
26       To  solve  this,  pen creates its own log file, which contains the real
27       client address, the time of the access, the target server  address  and
28       the first few bytes of the requests.
29
30       Mergelogs  reads  pen's log file and the log files of all load balanced
31       web servers, compares each entry and creates a combined log  file  that
32       looks  as  if  the  web  server  cluster were a single physical server.
33       Client addresses are replaced with the real client addresses.
34
35       In the event that no matching client address can be found  in  the  pen
36       log,  the server address is used instead. This should never happen, and
37       is meant as a debugging tool. A large number of  these  indicates  that
38       the server system date needs to be set, or that the jitter value is too
39       small.
40
41       You probably don't want to use this program. Penlog is a much more ele‐
42       gant and functional solution.
43
44

OPTIONS

46       -c     Do not cache pen log entries. The use of this option is not rec‐
47              ommended, as it will make mergelogs search the  entire  pen  log
48              for every line in the web server logs.
49
50       -d     Debugging (repeat for more).
51
52       -p penlog
53              Log file from pen.
54
55       -j jitter
56              Jitter  in  seconds (default 600). This is the maximum variation
57              in time stamps in the pen and web server log  files.  A  smaller
58              value will result in a smaller pen log cache and faster process‐
59              ing, at the risk of missed entries.
60
61       -t seconds
62              The difference in seconds between the time on the pen server and
63              UTC.  For example, this is 7200 (two hours) in Finland.
64
65       server:logfile
66              Web server address and name of log file.
67
68

AUTHOR

70       Copyright (C) 2001-2015 Ulric Eriksson, <ulric@siag.nu>.
71
72

SEE ALSO

74       pen(1), webresolve(1), penlog(1), penlogd(1)
75
76
77
78                                     LOCAL                        MERGELOGS(1)