Log Monitoring Workflow
Monitoring multiple log sources simultaneously is one of tmux's most practical use cases. This lesson builds a structured multi-pane log monitoring workspace.
Learning Focus
Build a reusable log monitoring session that auto-assigns sources to panes and is easily restartable.
Basic: Single Log Pane
tmux new -s logs
tail -f /var/log/syslog
Detach with Ctrl+b d. The log tail keeps running.
Practical: Multi-Source Log Session
~/bin/logwatch.sh
#!/bin/bash
SESSION="logwatch"
tmux has-session -t "$SESSION" 2>/dev/null && tmux attach -t "$SESSION" && exit
tmux new -s "$SESSION" -n "system" -d
# Split into 3 rows for system logs
tmux split-window -v -t "$SESSION:system"
tmux split-window -v -t "$SESSION:system.1"
tmux send-keys -t "$SESSION:system.0" "journalctl -f" Enter
tmux send-keys -t "$SESSION:system.1" "tail -f /var/log/auth.log" Enter
tmux send-keys -t "$SESSION:system.2" "tail -f /var/log/syslog" Enter
# Window 2: application logs
tmux new-window -t "$SESSION" -n "app"
tmux split-window -v -t "$SESSION:app"
tmux send-keys -t "$SESSION:app.0" "tail -f /srv/myapp/logs/app.log" Enter
tmux send-keys -t "$SESSION:app.1" "tail -f /srv/myapp/logs/error.log" Enter
# Window 3: web server logs
tmux new-window -t "$SESSION" -n "nginx"
tmux split-window -v -t "$SESSION:nginx"
tmux send-keys -t "$SESSION:nginx.0" "tail -f /var/log/nginx/access.log" Enter
tmux send-keys -t "$SESSION:nginx.1" "tail -f /var/log/nginx/error.log" Enter
tmux select-window -t "$SESSION:system"
tmux attach -t "$SESSION"
Searching Logs in Copy Mode
When you need to search backward through log history:
1. Go to the log pane
2. Press Ctrl+b [ → Enter copy mode (freezes output)
3. Press / → Search prompt
4. Type: error → Search for "error"
5. Press Enter, then n → Jump through matches
6. Press q → Exit copy mode (resume live tail)
tip
The copy mode freeze lets you read historical output while the log continues to update in the background. When you exit copy mode, you instantly jump back to the live tail.
Log Rotation Awareness
If tail -f stops updating after log rotation, restart with:
tail -F /var/log/app.log # capital F: follow by name, not file descriptor
Use tail -F instead of tail -f for files that may rotate.
Grep Filtering in a Pane
Watch only specific patterns:
# Only errors
tail -F /var/log/app.log | grep --line-buffered "ERROR\|WARN"
# Only HTTP 5xx responses
tail -F /var/log/nginx/access.log | grep --line-buffered " 5[0-9][0-9] "
# Colorized output
tail -F /var/log/app.log | grep --line-buffered --color=always "ERROR"
Timestamped Log Capture
Log everything a pane outputs to a file for audit:
# Pipe pane output to a log file
tmux pipe-pane -o -t logwatch:nginx.0 "cat >> /var/log/tmux-captures/nginx-$(date +%Y%m%d).log"
# Stop capture
tmux pipe-pane -t logwatch:nginx.0