Introduction

Logstalgia is a website traffic visualization that replays or streams web-server access logs as a pong-like battle between the web server and an never ending torrent of requests.

Requests appear as colored balls (the same color as the host) which travel across the screen to arrive at the requested location. Successful requests are hit by the paddle while unsuccessful ones (eg 404 - File Not Found) are missed and pass through.

The paths of requests are summarized within the available space by identifying common path prefixes. Related paths are grouped together under headings. For instance, by default paths ending in png, gif or jpg are grouped under the heading Images. Paths that don’t match any of the specified groups are lumped together under a Miscellaneous section.

Requirements

Logstalgia requires a video card supporting OpenGL. For this reason you should typically run Logstalgia on your workstation rather than on the web-server itself (unless your workstation is the web-server).

As Logstalgia is designed to playback logs in real time you will need a log from a fairly busy web-server to achieve interesting results (eg 100s of requests each minute).

An example access log is included.

Log Formats

Logstalgia supports several standardized access.log formats used by web servers such as Apache and Nginx:

NCSA Common Log Format (CLF) "%h %l %u %t \"%r\" %>s %b" NCSA Common Log Format with Virtual Host "%v %h %l %u %t \"%r\" %>s %b" NCSA extended/combined log format "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" NCSA extended/combined log format with Virtual Host "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""

The process id (%P), or some other identifier, may be included as an additional field at the end of the entry. This can be used with '--paddle-mode pid' where a separate paddle will be created for each unique value in this field.

Also supported is a pipe delimited Custom Log Format (more details on the Wiki):

1371769989|127.0.0.1|/index.html|200|1024|1|00FF00

Examples

Watch an example access.log file using the default settings:

logstalgia data/example.log

Watch the live access.log, starting from the most recent batch of entries in the log (requires tail). Note than '-' at the end is required for logstalgia to know it needs to read from STDIN:

tail -f /var/log/apache2/access.log | logstalgia -

To follow the log in real time, use the --sync option. This will start reading from the next entry received on STDIN:

tail -f /var/log/apache2/access.log | logstalgia --sync

Watch a remote access.log via ssh. The '-g' option is used here to group together URLs requested containing the string '/adclick.php' under the heading 'Ad Clicks':

ssh user@yourserver.com tail -f /var/log/apache2/access.log | logstalgia -g "Ad Clicks,/adclick.php,30" -

NOTE: tailing remote logs is not currently recommended on the Windows version due to buffering issues.

Related Software

You may also want to check out Gource, a software version control visualization tool.

Donations

If you like Logstalgia and would like to show your appreciation and encourage future work on this and other open source projects by the author, please consider making a donation!

Donate

Contact

If you use Logstalgia as a dashboard at your work and are interested in getting new features developed or maybe would like to discuss other bespoke visualization work please don't hesitate to contact me.

News

14 June 2018

Logstalgia 1.1.2 has been released.

Changes since 1.1.0:

Fixed compatibility with GLM 0.9.9.0.

Downloads:

11 October 2017

Logstalgia 1.1.0 has been released to address a font rendering issue with FreeType 2.8. The Windows build is not affected by this change.

Changes since 1.0.9:

Fixed rendering of FreeMonoBold with FreeType2 2.8 by disabling hinting.

Updated fonts.

Downloads:

5 October 2017

Logstalgia 1.0.9 has been released.

This fixes various issues with the file change detection (--detect-changes) on Linux/OSX/BSD as well as now building again on FreeBSD and OpenBSD.

Changes since 1.0.8:

Fixed compilation issues on FreeBSD (ehaupt) and OpenBSD (gonzalo-).

Fixed config change not being detected in some cases.

Downloads:

29 September 2017

Logstalgia 1.0.8 has been released.

Thanks to Intercontinental Exchange for funding a lot of the new features in this release.

Changes since 1.0.7:

Performance improvements.

Changed unsuccessful response code direction to match ball.

Added --screen option.

Added --window-position XxY option.

Added --frameless option.

Added --title option (mclang).

Added --detect-changes option to automatically reload config file.

Added --display-fields FIELDS to set fields shown mousing over a request.

Can now specify path separators, max path depth and min abbreviation depth.

Reload config (F5).

Save config (Ctrl+S) with updated display settings.

Fixed queued log entries not being deleted when seeking using the timeline.

Made --hide-url-prefix apply to https URLs (rudisimo).

Counter no longer overflows at 100000000.

Now requires SDL 2 to build (deprecated SDL 1.2 support removed).

Downloads:

21 October 2015

Logstalgia 1.0.7 has been released.

Changes since 1.0.6:

Added window frame toggle (F11).

Fixed crash loading large log files on Windows.

Fixed crash when taking a screenshot with an odd resolution.

Handle exception when user defined regular expression is invalid.

Fixed --hide-url-prefix not working (jettero).

Downloads:

21 March 2015

Due to Google Code shutting down I will soon be moving the Logstalgia homepage to Github. The source code is already hosted there.

I've disabled Wiki comments in the mean time due to link spam.

16 October 2014

Logstalgia 1.0.6 has been released.

Changes since 1.0.5:

Display invalid requests as having the path '???'.

Updated the boost autoconf macro.

Downloads:

3 April 2014

Well this hasn't happened in a while: a new Logstalgia release!

Logstalgia now uses SDL 2.0 when available, providing much better multi-monitor support.

You can also now date ranges on the command line using the --from and --to ISO_DATETIME options.

Various other improvements are listed below:

Performance improvements.

Multi-monitor support using SDL 2.0.

SDL 1.2 support is deprecated.

Can now specify the attribute to match the group regex (-g) against.

When using --sync, now catches back up after resuming from pause.

Added --pitch-speed option (control how fast balls travel).

Made default group matches case-insensitive (Sebastian Krzyszkowiak).

Display tokens in multi-paddle modes (Sebastian Krzyszkowiak).

Added window resizing and a full-screen toggle (alt-enter).

Take screenshots (F12).

Summarizer component content is now sorted.

IPv6 addresses now anonymized by default as well (last 64 bits).

New dependencies on libpng, GLEW.

Now requires GLM and Boost header-only libraries to build.

Downloads are now hosted on Github as Google Code no longer accepts adding new downloads:

If you package Logstalgia for a distro, please update the dependencies to use SDL 2 instead of SDL 1.2.