I want to monitor 2 different log files (at the time events appear in logs).

tail -f /var/log/file1 -f /var/log/file2  

For each file, I want to grep some patterns:

tail -f /var/log/file1 | grep '\(pattern1\|pattern2\)'  
tail -f /var/log/file2 | grep '\(pattern3\|pattern4\|pattern5\)' 

I do not know how to have this working all together. Furthermore I would like to print file1 logs output in red and file2 logs output in blue:

Again, I can do it for one file (snippet I grabbed in this forum):


tail -fn0 /var/log/file1 | while read line;
       if echo $line | grep -q '\(pattern1\|pattern2\)';then
          echo -e "{$RED}$line"

But I absolutely do not know how to do this for multiple files. Any ideas?

  • I was thinking: Redirecting all output in 1 file, and then use 'if / elif' or 'case' (dont know which one is faster)?
    – achille
    Commented Aug 16, 2017 at 19:27

3 Answers 3


If you want to parse multiple logs at the same time, you can use the following syntax:

tail -f /var/log/{log1,log2}

This will produce the desired output of all required logs, so you can then use the -e argument in grep to create multiple patterns. So all together:

tail -f /var/log/{log1,log2} | grep -ie "pattern1" -ie "pattern2" -ie "pattern3"

In regards to colourisation of grep, have a look at this excellent answer.

  • @Hauke <br/> tail -n 0 -f /var/log/syslog /var/log/auth.log | awk -v searchSyslog="kvm|KVM" -v searchAuth="FAILED|open" '/^==> \/var\/log\/syslog <==$/ {print "\033[0;31m"; pattern=searchSyslog }; /^==> \/var\/log\/auth.log <==$/ { print "\033[0;34m"; pattern=searchAuth }; $0 ~ pattern' -> prints only syslog. <br/>
    – achille
    Commented Aug 17, 2017 at 13:22
  • @Hauke <br/> tail -n 0 -f /var/log/syslog | awk -v searchSyslog="kvm|KVM" '/^==> \/var\/log\/syslog <==$/ {print "\033[0;31m"; pattern=searchSyslog }; $0 ~ pattern' ---> it prints all syslog so it works. <br/> tail -n 0 -f /var/log/auth.log | awk -v searchAuth="FAILED|opened" '/^==> \/var\/log\/auth.log <==$/ {print "\033[0;34m"; pattern=searchAuth }; $0 ~ pattern' ---> then I purposely fail root authentication (in order to have 'FAILED' pattern in /var/log/auth.log, the snippet outputs nothing. Now if I simply do a tail -f /var/log/auth.log | grep FAILED, it works. So I am stuck
    – achille
    Commented Aug 17, 2017 at 13:23
  • @ Brett <br/ > tail -f /var/log/auth.log | GREP_COLOR='01;34' egrep -i --color=always '^.*failed.*$|^.*opened.*$' -> works fine <br/ > tail -f /var/log/syslog | GREP_COLOR='01;31' egrep -i --color=always '^.*kvm.*$' -> works fine <br/ > tail -f /var/log/{auth.log,syslog} | GREP_COLOR='01;34' egrep -i --color=always '^.*failed.*$|^.*opened.*$' | GREP_COLOR='01;31' egrep -i --color=always '^.*kvm.*$' -> no output at all. <br/ > tail -f /var/log/{auth.log,syslog} | GREP_COLORS='01;34' grep --color=always '(FAILED\|opened)' | GREP_COLORS='01;31' grep --color=always '(KVM\|kvm)' -> no output.
    – achille
    Commented Aug 17, 2017 at 13:26
  • (I also tried with GREP_COLOR, which is deprecated but still supported in my grep version).
    – achille
    Commented Aug 17, 2017 at 13:27
 tail -n 0 -f file1 file2 |
   awk -v file1pattern="pattern1|pattern2" -v file2pattern="pattern3|pattern4" \
  '/^==> file1 <==$/ { print "\033[0;31m"; pattern=file1pattern };
   /^==> file2 <==$/ { print "\033[0;34m"; pattern=file2pattern }; $0 ~ pattern'

Here is the solution (thank you Mr Kitt and ducks).

How to Tail -f output with colors using only Awk and show the rest of the output?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .