multisort
multisort can merge multiple httpd logs from a single website distributed on multiple hosts (through round-robin DNS, for example) into a single date-ordered log. It's useful for preprocessing logs before feeding them to analyzers. It's written in C and is quite fast.
| Tags | Systems Administration |
|---|---|
| Licenses | GPL |
- All comments
Recent commentsmultisort v1.1.2 rollup patch
I use multisort in conjunction with the
webalizer
tool.
Unfortunately multisort v1.1 has a few minor problems.
Several patches were sent to the author.
I do not know if he received them because I never
received a reply.
I recommend that multisort users consider looking at my
unofficial
multisort v1.1.2 rollup patch page.
That page contains a patch to multisort v1.1, as well
as a revised multisort source that I call multisort v1.1.2.
The unofficial
multisort v1.1.2 rollup patch fixes a number of issues
related to multisort v1.1:
* Fixed sort bug where
01/Feb/2001:03:26:15 was incorrectly
sorted before
31/Jan/2001:23:25:08
* Fixed bugs related to very old dates and dates far in
the future
* Fixed bugs related to processing empty input files
* Correctly distinguishes between file EOF and read
errors
* Allows multisort to just process a single file (addresses
wish item in an above comment)
* Added slightly better sanity checks on timestamp
string formats
* Fixed a bug where multisort could hang on an I/O
error
* Correctly computes POSIX Seconds since the
Epoch values with full leapyear rules
* Speedup as per
Bertrand
Demiddelaer's patch (see a previous comment)
* Added -m maxage which will output only
lines less than or equal to maxage
seconds old instead of all lines
* Updated the usage message
NOTE: My rollup v1.1.2 patch is obviously unofficial.
Comments welcome.
Re: critiques
If you want it to be faster (and yes it can be *faster*), you can use an unofficial patch here:
http://bert.tuxfamily.org/patches/multisort.patch
critiques
This is a fast little util! Not only that, but it is a single file, seems pretty effecient.
My one qualm is that I am required to specify a second input file. It makes the util that much more diverse just being able to take a single file or 30 files. This really isn't a big deal, but sometimes files are already merged and just simply need to be sorted. Anyway, good work :)