# Log file analyzer

**URL:** <https://www.ruby-forum.com/t/log-file-analyzer/49877>\
**Category:** Ruby\
**Created:** [December 9, 2005, 4:29pm UTC](https://www.ruby-forum.com/t/log-file-analyzer/49877 "2005-12-09T16:29:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![michael.ulm](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c6cbf5/32.png) [@michael.ulm](https://www.ruby-forum.com/u/michael.ulm)\
**Post date:** [December 9, 2005, 4:29pm UTC](https://www.ruby-forum.com/t/log-file-analyzer/49877/1 "2005-12-09T16:29:01Z")

</div>

I want to analyze a log file using ruby. What is  
the most Ruby-like method to check the file for new  
entries (they will be appended to the file) and  
then get those new entries into the system?

I have a feeling that this should be rather simple,  
but I can’t think of an elegant way.

Thanks,

Michael

---

<div class="post-metadata">

**Author:** ![michael.ulm](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c6cbf5/32.png) [@michael.ulm](https://www.ruby-forum.com/u/michael.ulm)\
**Post date:** [December 9, 2005, 6:35pm UTC](https://www.ruby-forum.com/t/log-file-analyzer/49877/2 "2005-12-09T18:35:39Z")

</div>

Michael U. wrote:

> I want to analyze a log file using ruby. What is  
> the most Ruby-like method to check the file for new  
> entries (they will be appended to the file) and  
> then get those new entries into the system?
> 
> I have a feeling that this should be rather simple,  
> but I can’t think of an elegant way.

If data is appended to a single file all the time remember the last seek  
position and compare file size with this seek offset. If file size  
increased there is new data.

```
robert
```

---

<div class="post-metadata">

**Author:** ![michael.ulm](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c6cbf5/32.png) [@michael.ulm](https://www.ruby-forum.com/u/michael.ulm)\
**Post date:** [December 9, 2005, 10:29pm UTC](https://www.ruby-forum.com/t/log-file-analyzer/49877/3 "2005-12-09T22:29:58Z")

</div>

Michael U. wrote:

> I want to analyze a log file using ruby. What is  
> the most Ruby-like method to check the file for new  
> entries (they will be appended to the file) and  
> then get those new entries into the system?
> 
> I have a feeling that this should be rather simple,  
> but I can’t think of an elegant way.

The grandrapids.rb is working on Logz, a web application built with ruby  
on rails which allows you  
to track, annotate, and follow a log analysts workflow. Some proof of  
concept code was released on  
their web site ([http://www.gr-ruby.org/wiki](http://www.gr-ruby.org/wiki)). It is in the works right  
now, but it will allow you  
track multiple types of logs from multiple systems from within Logz, and  
it is easily extendable by  
the user to add their own custom log files. If something like this  
interests you, please let the  
group know by responding to this thread or joining their mailing list  
and hollaring at them.

Zach

---

<div class="post-metadata">

**Author:** ![michael.ulm](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c6cbf5/32.png) [@michael.ulm](https://www.ruby-forum.com/u/michael.ulm)\
**Post date:** [December 9, 2005, 11:23pm UTC](https://www.ruby-forum.com/t/log-file-analyzer/49877/4 "2005-12-09T23:23:02Z")

</div>

Michael U. wrote:

> Michael
> 
> –  
> Michael U.  
> R&D Team  
> ISIS Information Systems Austria  
> tel: +43 2236 27551-219, fax: +43 2236 21081  
> e-mail: removed\_email\_address@domain.invalid  
> Visit our Website: [www.isis-papyrus.com](http://www.isis-papyrus.com)

Comment, since I don’t have an answer for you: this is very  
O/S-specific, esp win32. (also helps to mention which ruby release  
you’re using, and how you installed it) In general (non-win32), you  
could probably combine combine code that watches directories for  
changes, either by storing mtimes in a dict, or by fcntl, with a  
tail-type utility.