mergelogs - merge and consolidate web server logs
-p penlog [-c] [-d] [-j jitter] [-t seconds] server1:logfile1
mergelogs -p pen.log 10.0.0.1:access_log.1 10.0.0.2:access_log.2
mergelogs -p pen.log 10.0.18.6:access_log-10.0.18.6
When pen is used to load balance web servers, the web server log file lists all
accesses as coming from the host running pen. This makes it more difficult to
analyze the log file.
To solve this, pen creates its own log file, which contains the real client
address, the time of the access, the target server address and the first few
bytes of the requests.
Mergelogs reads pen's log file and the log files of all load balanced web
servers, compares each entry and creates a combined log file that looks as if
the web server cluster were a single physical server. Client addresses are
replaced with the real client addresses.
In the event that no matching client address can be found in the pen log, the
server address is used instead. This should never happen, and is meant as a
debugging tool. A large number of these indicates that the server system date
needs to be set, or that the jitter value is too small.
You probably don't want to use this program. Penlog is a much more elegant and
- Do not cache pen log entries. The use of this option is not recommended,
as it will make mergelogs search the entire pen log for every line in the
web server logs.
- Debugging (repeat for more).
- -p penlog
- Log file from pen.
- -j jitter
- Jitter in seconds (default 600). This is the maximum variation in time
stamps in the pen and web server log files. A smaller value will result in
a smaller pen log cache and faster processing, at the risk of missed
- -t seconds
- The difference in seconds between the time on the pen server and UTC. For
example, this is 7200 (two hours) in Finland.
- Web server address and name of log file.
Copyright (C) 2001-2015 Ulric Eriksson, <firstname.lastname@example.org>.
pen(1), webresolve(1), penlog(1), penlogd(1)