☰

如何自訂終端查看日誌時linux日誌的輸出格式？

tag-icon • tag-icon linux logs
如何自訂終端查看日誌時linux日誌的輸出格式？

當我運行這個監視命令時

$ sudo tail -f /var/log/ufw.log | cat -n
     1  May 23 03:04:25 Vultr-Ubuntu14-Tokyo kernel: [51809.671147] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=85.48.173.107 DST=45.32.41.183 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=25617 DF PROTO=TCP SPT=41052 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0
     2  May 23 03:04:26 Vultr-Ubuntu14-Tokyo kernel: [51810.671232] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=85.48.173.107 DST=45.32.41.183 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=25618 DF PROTO=TCP SPT=41052 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0
     3  May 23 03:04:27 Vultr-Ubuntu14-Tokyo kernel: [51811.671298] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=85.48.173.107 DST=45.32.41.183 LEN=60 TOS=0x00 PREC=0x00 TTL=51 ID=25619 DF PROTO=TCP SPT=41052 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0
     4  May 23 03:05:16 Vultr-Ubuntu14-Tokyo kernel: [51861.074788] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=125.212.219.135 DST=45.32.41.183 LEN=40 TOS=0x00 PREC=0x00 TTL=239 ID=54321 PROTO=TCP SPT=43336 DPT=6379 WINDOW=65535 RES=0x00 SYN URGP=0
     5  May 23 03:05:31 Vultr-Ubuntu14-Tokyo kernel: [51875.345595] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=61.153.142.165 DST=45.32.41.183 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=1488 DF PROTO=TCP SPT=11916 DPT=19502 WINDOW=64240 RES=0x00 SYN URGP=0
     6  May 23 03:05:34 Vultr-Ubuntu14-Tokyo kernel: [51878.297557] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=61.153.142.165 DST=45.32.41.183 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=1788 DF PROTO=TCP SPT=11916 DPT=19502 WINDOW=64240 RES=0x00 SYN URGP=0
     7  May 23 03:05:40 Vultr-Ubuntu14-Tokyo kernel: [51884.313934] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=61.153.142.165 DST=45.32.41.183 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=2283 DF PROTO=TCP SPT=11916 DPT=19502 WINDOW=64240 RES=0x00 SYN URGP=0
     8  May 23 03:07:47 Vultr-Ubuntu14-Tokyo kernel: [52011.511521] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=222.161.53.246 DST=45.32.41.183 LEN=52 TOS=0x00 PREC=0x00 TTL=106 ID=9610 DF PROTO=TCP SPT=30408 DPT=22905 WINDOW=8192 RES=0x00 SYN URGP=0
     9  May 23 03:07:50 Vultr-Ubuntu14-Tokyo kernel: [52014.551342] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=222.161.53.246 DST=45.32.41.183 LEN=52 TOS=0x00 PREC=0x00 TTL=106 ID=13131 DF PROTO=TCP SPT=30408 DPT=22905 WINDOW=8192 RES=0x00 SYN URGP=0
    10  May 23 03:07:56 Vultr-Ubuntu14-Tokyo kernel: [52020.556294] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=222.161.53.246 DST=45.32.41.183 LEN=48 TOS=0x00 PREC=0x00 TTL=106 ID=20064 DF PROTO=TCP SPT=30408 DPT=22905 WINDOW=8192 RES=0x00 SYN URGP=0
    11  May 23 03:15:39 Vultr-Ubuntu14-Tokyo kernel: [52483.448066] [UFW BLOCK] IN=eth0 OUT= MAC=56:00:00:27:45:2d:fe:00:00:27:45:2d:08:00 SRC=93.174.93.50 DST=45.32.41.183 LEN=65 TOS=0x08 PREC=0x00 TTL=242 ID=54321 PROTO=UDP SPT=35266 DPT=53 LEN=45

看起來不錯，但我想控制更多，例如我想隱藏Vultr-Ubuntu14-Tokyo我認為是主機名的內容，我還想在每個日誌行之間放置一個空行，這樣它會變得更寬鬆，看起來更舒服，而且我還想改變每個指令的顏色等。

我記得我可以PS1在 Ubuntu 上自訂顏色和位置以及許多其他內容，如下所示，所以我想知道如何為 linux(ubuntu) 日誌做類似的事情。

export PS1="
$BBlue[\h] $BBlue\t $BBlue\u No.$BBlue\# -> $BBlue\w$Color_Off
\$ "

謝謝。

答案1

yum install ccze (Red Hat/CentOS)

或者

apt-get install ccze (Debian/Ubuntu)

使用：

tail -f /var/log/ufw.log | ccze

相關內容