Log Colourizing with ccze

Part of the extreme fun of administrating servers, is to watch endless streams of log files. It is so exciting it's hard to write this introduction without becoming indescribably agitated.

One thing is a bit annoying though. Log files can be often hard to parse visually and quickly given the amount of information they may contain. To solve this issue there's a thing called log colourizing, which is used to describe applications that can take a log file as an input and return a prettified version of it. There are several options for doing that but ccze is the one we like.

Installation and usage

• install is simple

apt install ccze

• here you go, witness the magic

ccze < /var/log/some.log

PRO Tips

scrollback

By default ccze uses curses for colourizing things. This will prevent the ability to scroll back because it will use a limited terminal emulator mode without buffer. If you have the habit to use tail -f to monitor logs in tmux or screen and scrollback from time to time, and/or hit the enter key to help visually mark a new chunk of log, then you're better off choosing the ANSI output of ccze:

tail -f /var/log/mail.info | ccze -p postfix -A

Default colour schemes

cczve comes with several presets for most common log files, named plugins and called with -p (see MAN). It can be extended as C (see source files), and the colours used can be tweaked in either /etc/colorizerc or $HOME/.colorizerc.