Slashdot Mirror
Logfiles Made Interesting with glTail
Fudgie writes "My boss claimed it was pretty much impossible to create an entertaining way to visualize server traffic and events in a short time frame, so of course I had to prove him wrong. A weekend of neglecting my family produced a small ruby program which connects to your servers via SSH, grabs and parses data from Apaches access log and Ruby on Rails production log, and displays your traffic and statistics in real-time using a simple OpenGL interface (tested under Linux and Mac OS/X). It's a bit hard to explain over text, so please have a look at fudgie.org for an example movie, and more information."
...I'm afraid that's the nearest I've seen to a simulated pissing contest ever! B^>
Rgds
Damon
http://m.earth.org.uk/
...we just made his log screen look like a bukkake flick.
And it looks like lots of things taking a wee. Once the site is slashdotted, it'll be a veritable golden shower...
Nice work though.
Task Mangler
tell the engineer it can't be done
The most entertaining way I ever saw to view logs was Visitorville-its kind of like SimCity meets web logging.
It's pretty obvious that fudgie.org is just the name of the site and glTail is the name of the program.
Anything put into a logfile could be parsed and shown. I've tried with emails, shoutcast listeners and server logins, but they're not as interesting to show in the movie as I don't have the kind of traffic to make it useful.
Obligatory jokes about 'taking the piss' aside, that is brilliant. It's the ultimate 'machine that does ping' (to name an old sketch) to keep management amused, but also provides real data. I bet that screen will go ballistic when you get Slashdotted (also a good way to visualise DDoS, maybe?).
I was about to say that it's a sort of etherape on steroids, but I've just realised your visualisation could benefit etherape instead (if you don't know etherape, look it up. No tools identifies a virus infection quicker).
Class, I'm impressed.
Insert
Notice in the movie that one of the sites being monitored is fudgie.org, which is what is linked to here. This looks like a ploy to visualize the slashdot effect. :) Wonder what that must look like. Might tax the renderer pretty hard. I guess that is one way to get load testing done!
-molo
Using your sig line to advertise for friends is lame.
didn't someone once do a version of doom that displayed network activity?
I recall seeing screenshots, but that was years ago.
You gotta add an 'Asteroids' ship on the screen that lets you shoot down connections!
"Oh, look! Bob just logged on... let's get 'em!"
...
"IT support. How can I help you?"
"Hi, this is Bob..."
--
X's and O's for all my foes.
Man this is cool. Very cool.
Ken Lai
Luckily, I saw the movie before the meltdown of the server. It always pays to be on time. ;)
...' scrolling top to bottom; like the cast of a movie.
For those unlucky and late, actually, you missed a competition of peeing coloured snowflakes from the right versus doing the same from the left.
Only, the sources on the left are much better at aiming.
Plus, you have some 'Login
Heads up, Fudgie, it is truely the most amazing display of log files ever creeping across my eyes.
Keep the good work up, and please post again when you have something actually useful for the sysadmin.
I declare you 'King of Log Candy' !
All I see now is blonde, brunette, redhead.
WARNING: Smartphones have side effects--most of them undocumented.
I'd enjoy a postfix version
Serious prostrate problems at Fundie.org, it appears... I'm looking forward to plugging this in to sysstat for some over-utilized servers I manage....
-- @rjamestaylor on Ello
Comment removed based on user account deletion
Hey, this is not the correct way to apply the GNU GPL licence. I don't know whether you had very little time available or just don't care, but the correct way is to explain exactly what licence (full title) the program is under and enable the user to find the licence (provide a copy of it and explain that the author of the licence is FSF, giving their address). We nerds of course understand completely what you mean, but other people may have no idea what you are talking about. To learn how to apply GPL on your program read this.
Good work, by the way. Was there any reason you preferred GPLv2 and not GPLv3? Also from the wording of your licence I think that you intended this to be available only under v2 and not v3 (you say "Licensed under the GPLv2" without a "or any later version" clause).
I loved this line:
"Certain processes are vital to the computer's operation and should not be killed. For example, after I took the screenshot of myself being attacked by csh, csh was shot by friendly fire from behind, possibly by tcsh or xv, and my session was abruptly terminated."
I believe this sort of tool is useful for realtime monitoring of net resources utilization. It can assist you giving graphic clues when something goes out of the usual parameters, like DDoS, slashdotments (sp?), router failure, etc. Depending on information being monitored and how it is displayed, it could also be used for long-term decision like buying more hardware or switching software because the current setup is not handling the load.
One nice, but more local example is the "duck" activity monitor (a windowmaker classic): a duck floats by a mass of water. If the water gets to high, it means the memory usage is high; if it has too much bubbles, processor is being hit. No percentages nor text, just a simple graphic.
A place I used to work is now trying to develop something like this: visualizations where you can tell trouble is brewing in a glance. This is useful for them because their services involved a lot of maintenance of third-party networks but having someone dedicated to nanny all systems is "dumb" and error-prone. Their solution consists of multiple screens around the office showing how the systems they are responsible for are behaving.
Perhaps the parser doesn't like my Apache logs?
2437 frames in 5.000 seconds = 487.400 FPS
Elements[0], Activities[0]
2550 frames in 5.001 seconds = 509.898 FPS
Elements[0], Activities[0]
1182 frames in 5.002 seconds = 236.305 FPS
Elements[0], Activities[0]
987 frames in 5.001 seconds = 397.321 FPS
Elements[0], Activities[0]
2534 frames in 5.003 seconds = 506.496 FPS
Elements[0], Activities[0]
2506 frames in 5.000 seconds = 501.200 FPS
Elements[0], Activities[0]
2505 frames in 5.000 seconds = 501.000 FPS
Elements[0], Activities[0]
2603 frames in 5.000 seconds = 520.600 FPS
Elements[0], Activities[0]
2548 frames in 5.000 seconds = 509.600 FPS
Elements[0], Activities[0]
2561 frames in 5.000 seconds = 512.200 FPS
Elements[0], Activities[0]
2559 frames in 5.001 seconds = 511.698 FPS
Elements[0], Activities[0]
2567 frames in 5.029 seconds = 510.439 FPS
Elements[0], Activities[0]
2548 frames in 5.000 seconds = 509.600 FPS
Elements[0], Activities[0]
2193 frames in 5.001 seconds = 438.512 FPS
Elements[0], Activities[0]
2300 frames in 5.000 seconds = 460.000 FPS
Elements[0], Activities[0]
2508 frames in 5.001 seconds = 501.500 FPS
Elements[0], Activities[0]
its still NOT entertaining.. Its more bizzare then anything else.
---- Booth was a patriot ----
Why use ssh + tail -f when one can send the output to a centralized syslog server? There isn't any need to setup an account, keys, etc. when you can have the individual servers consolidate the data for you.
This would be very cool indeed.
I guess we could download the source and do it ourselves!
I don't know why so many comments were hating on this tool. As a big fan of "visualization" (Tufte books, etc.) I find Fudgie easy to understand and useful. The possibilities here are amazing.
Kudos to you, Fudgie (er...that sounds kinda bad)
Nothing is inexplicable; only unexplained -Tom Baker, Doctor Who
Remote syslog also means that your servers are more secure: (a) because it is harder for crackers to falsify remote logs as they need to compromise two machines, not just one; and (b) because your visualisation program doesn't need access to SSH keys for all of the machines it monitors, so a compromise on the visualisation computer doesn't automatically mean that all of the servers can also be compromised. However, you could presumably adapt this tool to use syslog quite easily.
>north
You're an immobile computer, remember?
Uh, wtf are you talking about?
Sure it can. You'd just need to send the sudo-command line, and send the password if you got a password prompt in return. Or you could just let other users read the access log for a while, so see how it looks before you decide if this is something you'd like to try.
This would be really handy for MySQL queries. My shared MySQL server runs 10 to 200 queries per second for me alone. Finding a good way to represent the data could be interesting.
Be relentless!
If you want to run glTail on Windows:
1. Use the One-click Ruby installer from rubyforge (not Cygwin ruby)
2. Make sure to `gem install net-ssh`
3. Change "require 'glut'" to "require 'glut_prev'" to enable legacy GLUT ruby bindings
Took me a while to figure this out.
So...how many hours of unpaid overtime did your boss get out of you?
I like getting paid for my awesome work. Kudos, though.
You save only 59 seconds over 8 miles by going 75 instead of 65. Do you really have to pass that guy? Do the Math!
fastfinge> I used to have a program that would play a musical note every time someone hit a port. so for each port it would have a different note
fastfinge> i put it in the dmz
fastfinge> much musical entertainment
fastfinge> I should find the source for that thing again. i could change midi intruments depending on the type of packet.
fastfinge> or maybe create length and timbre data from the source IP?
2006-09-20
A lot of my time at work is spent looking at logfiles from webservers, applications servers, and databases looking for things about to break down, but after I introduced this I just need to glance at a screen to instantly see if some server has stopped answering, is taking too long to answer, or is generating way more exceptions than normal. I also add an event (the login text bouncing down the screen in the movie) on each money generating activity, which always amazes marketing people when they walk by.
RDP? VNC? RSH???
Don't thank God, thank a doctor!
Very cool.
This is the first time I have felt I needed to say anything on Slashdot in a while.
Well done, sir.
They heard about your cool project and want to subject you to a series of tedious interviews, ultimately not offering you a job because you didn't go to stanford.
If you just install any of the standard RRDTool frontends out there, e.g. cacti, or my personal favorite, munin (far easier to install/extend/use than cacti), and check them regularly, it's not hard to tell when something's wrong. Traffic and usage patterns are pretty consistent from week to week on the boxes I've administered. After a month of checking graphs in munin daily, I could instantly tell when a CPU, network, memory, or process count graph was out of whack.
After a few more months, not only could I tell at a glance that something was wrong, but I could use the information in them to figure out *what* was wrong.
You'd be hard pressed to try to come up with a combined visualization that was actually *more* useful (i.e., equally data-rich) to a trained eye.
Grab the divx version of the movie, then.
Almost half a decade? Holy shit, that's nearly one-twentieth of a century!
Slashdot quality declines as the number of hot grits posts decreases. - Provolt's Law, Apr-09-2005
Even more to the point, the article says the boss challenged him to create a visualization tool that was entertaining... this is sort of interesting, but entertaining? Or did Fudgie misspeak?
Slashdot quality declines as the number of hot grits posts decreases. - Provolt's Law, Apr-09-2005
Of course, the logical next step is to make it into a game. Log File Centipede!!!!1!11
Curiously, I spent a good half-minute staring at the animation. For a busy site this could actually be really useful, to watch a slashdotting as it unfolds in real-time, and to a skilled sysadmin it could offer the kind of timely info required to properly tune the server to survive the bursts.
I'm not going to start watching this thing 8 hours a day (though some drones would), but it definitely does have limited uses that aren't currently matched by other analysis tools.
-Billco, Fnarg.com
Movie OS
netcosm youtube vid
The Admin and the Engineer
On the website it mentions monitoring FTP, shoutcast, and DB queries. Have you coded these yet, or are those just to-dos? FTP and DB Queries would be interesting to see graphed.
Ah, finally someone else with this error. Been bugging me, and the person that reported it didn't mention running 64bit. That could be it. -- Erlend
I'd like to see a dDOS in action with this
people love fish-tanks
Table-ized A.I.
The next version will have an auto-fallback to this function if the exception is raised.
Is available at the site.
The thing is, Netcosm is officially a "research project" that isn't public, it's not something you can install and use today.
http://www.networkperformancedaily.com/2007/04/why_netcosm_is_not_a_product_y_1.html