Logfiles Made Interesting with glTail

Fudgie writes "My boss claimed it was pretty much impossible to create an entertaining way to visualize server traffic and events in a short time frame, so of course I had to prove him wrong. A weekend of neglecting my family produced a small ruby program which connects to your servers via SSH, grabs and parses data from Apaches access log and Ruby on Rails production log, and displays your traffic and statistics in real-time using a simple OpenGL interface (tested under Linux and Mac OS/X). It's a bit hard to explain over text, so please have a look at fudgie.org for an example movie, and more information."

Oh dear...

[DamonHD (794830)]

...I'm afraid that's the nearest I've seen to a simulated pissing contest ever! B^>

Rgds

Damon

Oh great...

[GodlikeDoglike (600594)]

...we just made his log screen look like a bukkake flick.

engineering management 101

[by Anonymous Coward]

tell the engineer it can't be done

Re:

[H310iSe (249662)]

Just want to give props, very nice you made my morning. Now to convert this to a heads up display for my helmet and I'm 1 step closer to becoming the motorcycle hacker I always dreamed I could be. And 1 step closer to earning a darwin award...

Visitorville

[by Anonymous Coward]

The most entertaining way I ever saw to view logs was Visitorville [visitorville.com]-its kind of like SimCity meets web logging.

Not "Fudgie", glTail

[gumpish (682245)]

It's pretty obvious that fudgie.org is just the name of the site and glTail is the name of the program.

Re:

[nacturation (646836)]

Also, "slash" is also British slang for "urinate".

And backslash is what happens if you urinate onto a parabolic surface?
 

Wow !

[cheros (223479)]

Obligatory jokes about 'taking the piss' aside, that is brilliant. It's the ultimate 'machine that does ping' (to name an old sketch) to keep management amused, but also provides real data. I bet that screen will go ballistic when you get Slashdotted (also a good way to visualise DDoS, maybe?).

I was about to say that it's a sort of etherape on steroids, but I've just realised your visualisation could benefit etherape instead (if you don't know etherape, look it up. No tools identifies a virus infection quicker).

Class, I'm impressed.

Re:

[bughunter (10093)]

I bet that screen will go ballistic when you get Slashdotted

Look closer. It already is ballistic.

just a ploy to visualize the slashdot effect

[molo (94384)]

Notice in the movie that one of the sites being monitored is fudgie.org, which is what is linked to here. This looks like a ploy to visualize the slashdot effect. :) Wonder what that must look like. Might tax the renderer pretty hard. I guess that is one way to get load testing done!

-molo

Re:just a ploy to visualize the slashdot effect

[Fudgie (594631)]

Still running at 30 fps with ~25 requests / second.

Re:just a ploy to visualize the slashdot effect

[Fudgie (594631)]

http://www.fudgie.org/slashdotted.jpg [fudgie.org] for how that looks.

Oh, Sweeeetness!

[avirrey (972127)]

You gotta add an 'Asteroids' ship on the screen that lets you shoot down connections!

"Oh, look! Bob just logged on... let's get 'em!"

...

"IT support. How can I help you?"

"Hi, this is Bob..."

--
X's and O's for all my foes.

Compiz for syslogs - ohmygawd !

[udippel (562132)]

Luckily, I saw the movie before the meltdown of the server. It always pays to be on time. ;)

For those unlucky and late, actually, you missed a competition of peeing coloured snowflakes from the right versus doing the same from the left.
Only, the sources on the left are much better at aiming.
Plus, you have some 'Login ...' scrolling top to bottom; like the cast of a movie.

Heads up, Fudgie, it is truely the most amazing display of log files ever creeping across my eyes.
Keep the good work up, and please post again when you have something actually useful for the sysadmin.

I declare you 'King of Log Candy' !

Ob quote

[Provocateur (133110)]

All I see now is blonde, brunette, redhead.

Sorry, but the boss won this bet

[nurb432 (527695)]

its still NOT entertaining.. Its more bizzare then anything else.

syslog, not ssh+tail -f

[allenw (33234)]

Why use ssh + tail -f when one can send the output to a centralized syslog server? There isn't any need to setup an account, keys, etc. when you can have the individual servers consolidate the data for you.

seconded

[Cheesey (70139)]

Remote syslog also means that your servers are more secure: (a) because it is harder for crackers to falsify remote logs as they need to compromise two machines, not just one; and (b) because your visualisation program doesn't need access to SSH keys for all of the machines it monitors, so a compromise on the visualisation computer doesn't automatically mean that all of the servers can also be compromised. However, you could presumably adapt this tool to use syslog quite easily.

Running glTail on Windows

[Mazin07 (999269)]

If you want to run glTail on Windows:

1. Use the One-click Ruby installer from rubyforge (not Cygwin ruby)
2. Make sure to `gem install net-ssh`
3. Change "require 'glut'" to "require 'glut_prev'" to enable legacy GLUT ruby bindings

Took me a while to figure this out.

Re:Looks promising

[Fudgie (594631)]

Anything put into a logfile could be parsed and shown. I've tried with emails, shoutcast listeners and server logins, but they're not as interesting to show in the movie as I don't have the kind of traffic to make it useful.

Re:Looks promising

[DudeTheMath (522264)]

So...how many hours of unpaid overtime did your boss get out of you?

I like getting paid for my awesome work. Kudos, though.

Re:doom

[xappax (876447)]

perhaps you mean this: http://www.cs.unm.edu/~dlchao/flake/doom/ [unm.edu]

Re:

[Fudgie (594631)]

Shouldn't be too hard. I'll cook one up this evening.

Re:

[fmobus (831767)]

I believe this sort of tool is useful for realtime monitoring of net resources utilization. It can assist you giving graphic clues when something goes out of the usual parameters, like DDoS, slashdotments (sp?), router failure, etc. Depending on information being monitored and how it is displayed, it could also be used for long-term decision like buying more hardware or switching software because the current setup is not handling the load.

One nice, but more local example is the "duck" activity monitor (a

Re:Wait, what... they're not interesting?

[Fudgie (594631)]

A lot of my time at work is spent looking at logfiles from webservers, applications servers, and databases looking for things about to break down, but after I introduced this I just need to glance at a screen to instantly see if some server has stopped answering, is taking too long to answer, or is generating way more exceptions than normal. I also add an event (the login text bouncing down the screen in the movie) on each money generating activity, which always amazes marketing people when they walk by.