MERGELOGS(1)

💖 MERGELOGS(1) — the merge-and-consolidate-web-server-logs girlie 💖

okay so bestie, this is a page from the General Commands Manual and it's all about mergelogs — literally the tool that smooshes your web server logs together. let's get into it 🫶

---

✨ NAME ✨

mergelogs — merge and consolidate web server logs 🌈

---

🎀 SYNOPSIS 🎀

mergelogs -p penlog [-c] [-d] [-j jitter] [-t seconds] server1:logfile1
[server2:logfile2 ...]

that's the whole vibe, right there. one pen log, a bunch of server:logfile pairs, and she's off ✨

---

🌸 EXAMPLES 🌸

here's how the girlies actually run it:

mergelogs -p pen.log 10.0.0.1:access_log.1 10.0.0.2:access_log.2

mergelogs -p pen.log 10.0.18.6:access_log-10.0.18.6
10.0.18.8:access_log-10.0.18.8

see? you pass the pen log with -p, then each server as address:logfile. that's it. iconic. 💅

---

🦋 DESCRIPTION 🦋

okay so context, because it matters:

When pen is doing its load-balancing thing across your web servers, the web server log file is a whole mess — every single access gets listed as coming from the host that's running pen. which makes analyzing that log file so much harder 😭. it's giving "who even are these people".

so to fix that, pen makes its own log file! and that one actually has the tea: the real client address, the time of the access, the target server address, and the first few bytes of the requests. chef's kiss ✨

and here's where our main character comes in: mergelogs reads pen's log file AND the log files of all the load-balanced web servers, compares every single entry, and builds a combined log file that looks like the web server cluster was one single physical server the whole time. and the client addresses get replaced with the REAL client addresses 🎉 slay.

---

now, the plot twist nobody asked for: if no matching client address can be found in the pen log, the server address is used instead. and like — this should never happen, it's literally just a debugging tool. if you're seeing a large number of these, that's your sign that either the server system date needs to be set, or your jitter value is too small. fix ur clock bestie 🕰️

real talk though: you probably don't want to use this program. penlog is a much more elegant and functional solution. she said what she said 💅

---

💅 OPTIONS 💅

• -c — do not cache pen log entries. the use of this option is not recommended, because it'll make mergelogs search the entire pen log for every single line in the web server logs. it's giving "why would you do this to yourself" 😭
• -d — debugging! repeat it for more. more -d, more debug. stack 'em like scrunchies 🎀
• -p penlog — the log file from pen. your source of truth, bestie ✨
• -j jitter — jitter, in seconds. default is 600. this is the maximum variation in time stamps between the pen and web server log files. a smaller value gives you a smaller pen log cache and faster processing, but at the risk of missed entries. tradeoffs, we love her 🙈
• -t seconds — the difference in seconds between the time on the pen server and UTC. for example, this is 7200 (two hours) in Finland. 🇫🇮 timezone math, we've all been there
• server:logfile — web server address and the name of the log file. one per server, as many as you want 🦋

---

👑 AUTHOR 👑

Copyright (C) 2001-2015 Ulric Eriksson, <ulric@siag.nu>. give her her flowers 💐

---

🌈 SEE ALSO 🌈

pen(1), webresolve(1), penlog(1), penlogd(1)

go read those next, bestie. especially penlog(1) — remember what the page said 😌

---

and that's the whole page! this one lives in the LOCAL section of the manual — yes, the footer literally just says LOCAL, and it's filed under MERGELOGS(1), which is where you'll find her if you ever need to look her up again. mwah 💖✨