vlog - Logfile viewer for IP-Filter




vlog -r ] [ -i ] [ -g regexp ] [ -v regexp ]
-l logfile or -l{imsxladcq} ] [ -[<nn>]f or -f ]
-<nn> or -n <nn> ] [ -s <date> ] [ -e <date> ]
-o{dtuhfrilan} ] [ -t ] [ -d ] [ -w <nn> ]


vlog is a text-based real-time logfile viewer. Its primary aims are:


If an ipfilter logfile is being viewed, vlog's formatting process renders ipmon informations with some slight differences:


-r (rotated)
show not only the current logfile, but also the previously rotated ones (logfile.0, logfile.1, ...).

Note: gzipped rotated files are not supported: if you want to be able to browse them, you must first gunzip them, then eventually remove automatic compression option (maybe in /etc/newsyslog.conf).

-i (ipmon)
show only loglines generated by ipmon. Default behaviour is to show every line of logfile.

-g regexp (grep)
show only loglines that match the regular expression regexp.

-v regexp (grep -v)
show only loglines that do not match the regular expression regexp.

-l logfile of -l{imsxladcq...}
specify the logfile to read instead of /var/log/ipflog. The logfile path can be fully specified on command line, or a single letter can be used: i = /var/log/ipflog (default), m = /var/log/messages (or /var/adm/messages on Solaris), s = /var/log/syslog, x = /var/log/xferlog, l = /var/log/maillog, a = /var/log/authlog, d = /var/log/daemon, c = /var/cron/log (or /var/cron/olog on Solaris), q = /var/log/squid.

For instance, vlog -lm shows system messages.

You can define your own key-to-logfile mapping in /etc/vlog.conf or ~/.vlogrc. See vlogrc.sample for the syntax (which is rather strict).

``tail -f'' mode: format and print the last <nn> loglines (default 10) on stdout (no curses), then print them as soon as they are appended to logfile

-n <nn> or -<nn>
``print'' mode: print <nn> loglines on stdout and exit (no curses). If option -s is not given, the lines printed are the last ones.

-s [[Mmmdd] [hh[:mm[:ss]]  (start date)
show lines starting at specified date/time. If Mmm and dd are not given, use current day (ex: vlog -s Jul 21) (ex: vlog -s 12:30)

-e [[Mmmdd] [hh[:mm[:ss]]  (end date)
show lines up to specified date/time. This option implies simple text mode (no curses) (ex: vlog -s 12:30 -e 13:00)

-o{dtuhfrilan} (optional fields)
choose which optional fields to display.

For ipfilter logfiles the following fields are available: d=date, t=time, u=microseconds, h=hostname, f=interface, r=rule/group number, i=isba source rule number, l=IP header length.

For non-ipfilter logfiles the following fields are available: d=date, t=time, h=hostname, p=process name, i=pid of process.

Additionnally a=all optional fields and n=no optional fields.

If this option is not given, vlog arbitrarily chooses which fields to display according to window width. In curses mode this choice can be modified with the key o.

-t (text only)
for no curses modes: don't print ANSI codes (bold chars, etc). Suitable for redirecting output to a plain text file.

-w <nn> or -ww (terminal width)
for no curses modes: force vlog output to be nn chars max. Option -ww tells vlog to print full loglines whatever length they are.

-d (disguise)
disguises IP addresses and hostnames for publishing purposes. Broadcast, multicast, localhost addresses are unchanged. RFC1918 addresses have their last two bytes randomly changed, other addresses are completely changed. The first three letters of hostnames are randomized.

command-line options help.


vlog enters curses mode if none of the following options are given: -<nn>f, -<nn> or -n <nn>, -e <date>.

In curses mode, the terminal window is split into three areas:

Movement keys

Jump keys

Misc keys

``TAIL -f'' MODE

When option -f or -<nn>f is given on command line, vlog behaves like a ``tail -<nn>f logfile'' (see tail(1)). The only difference is that loglines are pretty-printed. This mode doesn't use curses. If current logfile is rotated, vlog silently switches to new logfile.

For instance: vlog -12f prints the last twelve lines of /var/log/ipflog, then wait and print new log lines as soon as they're appended to logfile.


This mode is entered when option -n <nn> or -<nn> or -e is given on command line. vlog simply prints out the specified lines and exits. Examples:

vlog -n 12 or vlog -12 print the last 12 lines of /var/log/ipflog.

vlog -s Jul 1 -e Jul 14 print log lines between specified dates.


Each IP-Filter log line contains the number of the group and rule that generated this log line.

If the ruleset currently loaded in kernel has been generated by the IP-Filter GUI isba (, which uses ``composite'' rules (one isba source rule may be compiled into many ipfilter rules), it is interesting to know which isba rule generated a given logline.

vlog can display the isba source rule number for each log line (optional field: key i) if the ruleset was generated by isba-1.1 or later.

In case the machine you run vlog on is a log-centralizing machine, vlog can show the isba rule number only for log lines generated by this machine, not foreign ones, because vlog needs to read the ipf.conf file.



Vlog's home page is