logwatch

Real-time log file analyzer and monitor for the terminal.

logwatch is a powerful, zero-configuration CLI tool for monitoring and analyzing log files in real time. It auto-detects common log formats (syslog, Apache/Nginx, Python, ISO 8601, and more), filters by severity level, searches with regex, and renders beautiful terminal output powered by Rich.

• Auto-format detection — identifies syslog, Apache combined, Nginx, Python logging, ISO 8601, and generic formats automatically
• Real-time tail & watch — follow files live with tail -f-like behavior; receive visual alerts on ERROR/CRITICAL lines
• Level filtering — show only WARN, ERROR, CRITICAL, etc. with color-coded output
• Regex search — grep across one or many log files with context lines and invert support
• Statistics & visualization — bar charts of level distribution, hourly activity heatmap, top IPs, HTTP status breakdown
• Multi-file support — all commands accept multiple files and label output per source
• Error extraction — quickly dump all error/critical lines from any log
• Log diff — compare level distributions between two log snapshots

Installation

pip install logwatch-cli

Requirements: Python 3.10+

Usage

# Tail last 20 lines and follow live
logwatch tail /var/log/syslog

# Follow multiple files, only WARN+
logwatch tail -l WARNING /var/log/nginx/access.log /var/log/nginx/error.log

# Search for pattern across logs
logwatch search "connection refused" /var/log/*.log

# Show statistics for a log file
logwatch stats /var/log/apache2/access.log

# Filter to ERROR+ and write to file
logwatch filter -l ERROR /var/log/app.log -o errors.log

# Watch live with alert panels for ERROR+
logwatch watch /var/log/app.log --alert-level ERROR

# Extract only errors
logwatch errors /var/log/syslog -n 100

# Detect log format
logwatch detect /var/log/syslog /var/log/nginx/access.log

# Compare two log files
logwatch diff /var/log/app.log.1 /var/log/app.log

Commands

Common Options

Configuration

No configuration file required. logwatch works out of the box. Pipe-friendly — all output goes to stdout; combine with standard Unix tools as needed.

# Pipe filtered output to less
logwatch filter -l ERROR /var/log/app.log | less -R

# Count errors per file
logwatch search "ERROR" /var/log/*.log --count

License

MIT © shazeus