/usr/share/loganalyzer/doc/textfiles.html is in loganalyzer 3.6.6+dfsg-2ubuntu1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><head>
<title>Using text log files with LogAnalyzer</title>
</head>
<body>
<h1>Using text log files with LogAnalyzer</h1>
<p><b>LogAnalyzer natively supports operting on text log files.</b> So there
is no need to put log data into databases. Each approach has advantages
and disadvantages, which we will not discuss in this paper. Here, we focus
on how text log files are supported.
<p>We assume that the reader is familiar with <a href="basics.html">basic
LogAnalyzer concepts</a>. If you are not, get aquainted to them, first.
<h2>Requirements for text log files </h2>
<p>LogAnalyzer can operate on any standard text log file, that means a file that
purely consists of printable characters and uses LF (linefeed, newline) characters
as log line terminators. Most importantly, this includes standard syslog files
as well as web server and other application logs.
<p>A data source is defined to pull data from a text log file. Note that only a single
text log file can be contained in any data source.
<h2>Working with text log files</h2>
<p><b>Text log files are just regular data sources. You can work with them like
with any other data sources, for example, you can browse them, search them,
generate graphics from the or base reports on their content.</b> Depending on the
size of the text log and on the operation being performed, performance may be
worse or even better than with using database-based data sources. For typical
operations and typical text file sizes, performance should be quite well.
<p>Note that some options make limited sense when working with text log files.
For example, you may set a filter with a broad date range, but the text log
file will, for obvious reasons, only provide what is currently contained in it.
For typical syslog files, that will probably mean they contain maximum one
day's data.
<h2>Use Cases for Text Log Files</h2>
<p>A typical use case is in a hosting environment. There, LogAnalyzer may
be used to do an online review of log data, via the web and without the need
to log into an SSH session. This can be very handy to learn what is currently
going on or, for example, to verify if an important mail left your system.
<p>Another use case is that you would like to keep an eye on some local text files,
for example while debugging an installation. Instead of reconfiguring your whole
logging system, you can set up a LogAnalyzer instance and point it to the log files
in question. Keep in mind that you are not restricted to syslog files. For example,
you may want to add additional application text log files as data sources as well.
With the cross-datasource search capability, you can quickly follow events across
the boundaries of log servers.
<p>For secuity sensitive-environments, the access to LogAnalyzer can be protected
by several levels, e.g. user authentication or IP ranges at the firewall or
http server level. Also, one may consider to activate a LogAnalyzer instance only
when actually needed to do troubleshooting and keep it "turned off" at other times.
The beauty of text log files is that you do not need to reconfigure the whole
logging system to do so. All that is needed is to disable the web site inside
the http server.
<p>[<a href="manual.html">manual index</a>] [<a href="http://loganalyzer.adiscon.com">LogAnalyzer site</a>]</p>
<p><font size="2">This documentation is part of the
<a href="http://loganalyzer.adiscon.com">Adiscon LogAnalyzer</a> project.<br>
Copyright © 2008-2011 by <a href="http://www.adiscon.com/">Adiscon</a>.
Released under the GNU GPL version 3 or higher.
<a href="http://loganalyzer.adiscon.com/commercial">Adiscon LogAnaylzer commercial licenses are also available.</a>
</font></p>
</body></html>
|