When administering multiple Linux servers, checking log files can quickly become tedious. Every time you need to investigate an issue, you may have to SSH into a server, locate the appropriate log file, and run tail -f to watch new entries.
Wouldn’t it be easier to run a command like this?
bash
taillog server_host /var/log/syslog
Ideally, the tool would connect to the remote server, display new log entries as they appear, and let you monitor several servers simultaneously. Even better, it would offer a split-screen interface with multiple log files displayed side by side.
Fortunately, several tools provide these capabilities. Some use SSH to stream logs directly from remote servers, while others are designed for viewing multiple log files in separate terminal panels or aggregating logs from an entire infrastructure.
This article explores the most useful options, from a simple shell wrapper to dedicated log-monitoring applications.
1. The Simplest Solution: SSH and tail
If you only need to follow a log file on a remote Linux server, SSH combined with tail is often all you need.
bash
ssh server_host ‘tail -F /var/log/syslog’
The -F option follows the file by name and attempts to reopen it if it is rotated or recreated. This is generally more suitable for system logs than tail -f.
If you need elevated privileges, use:
bash
ssh server_host ‘sudo tail -F /var/log/syslog’
The remote account must have permission to read the file, and sudo must be configured appropriately.
Create a Convenient taillog Command
You can wrap the SSH command in a shell function or script to avoid typing it every time.
Create a file named taillog in a directory on your PATH, such as ~/bin/taillog:
bash
#!/usr/bin/env bash
if [[ $# -ne 2 ]]; then
echo “Usage: taillog HOST LOGFILE” >&2
exit 1
fi
host=$1
logfile=$2
exec ssh “$host” “tail -F — ‘$logfile'”
Make it executable:
bash
chmod +x ~/bin/taillog
Now you can run:
bash
taillog server_host /var/log/syslog
For this simple example, the remote path should be trusted and should not contain shell metacharacters or quotes. For a more robust script that accepts arbitrary paths, use careful argument quoting or a remote helper that receives the path as a separate argument.
Configure SSH public-key authentication and host-key verification in advance so that connections do not require interactive password prompts.
Advantages
• No additional log-monitoring software is required on the remote server.
• Easy to implement and customize.
• Works with almost any Linux distribution that provides SSH and tail.
• Useful for occasional troubleshooting.
Disadvantages
• Each remote log requires its own SSH connection.
• Logs from multiple servers are not automatically displayed in separate panels.
• You must manage authentication and file permissions on each server.
For a small number of servers, this is an excellent starting point.
2. lnav: A Powerful Log Viewer With Remote SSH Support
Best for: Viewing and analyzing logs from multiple remote servers in one terminal interface.
lnav (Log File Navigator) is an interactive terminal application that goes beyond ordinary tail. It can merge logs into a common view, recognize log formats, highlight errors, search using regular expressions, and follow changes as they occur.
An especially useful feature is its built-in support for opening log files on remote machines over SSH. You do not need to install a separate log-monitoring agent on each server; the tool handles remote access through SSH and transfers a helper when necessary.
Install it using your distribution’s package manager or follow the instructions on the official lnav website.
For example, open a remote log:
bash
lnav user@server1:/var/log/syslog
You can also open multiple files from different servers:
bash
lnav \
user@server1:/var/log/syslog \
user@server2:/var/log/syslog \
user@server3:/var/log/syslog
This gives you a unified interactive log view rather than forcing you to switch between individual SSH sessions.
Why Use lnav?
• Remote log access over SSH.
• Automatic recognition of supported log formats.
• Search, filtering, and error highlighting.
• Multiple log files can be viewed together.
• Historical entries remain accessible while investigating an issue.
One important distinction: lnav merges recognized log entries into a common timeline. It is not primarily a fixed grid of independent panels.
If you specifically want one server in the left pane and another server in the right pane, multitail may be a better fit.
See the official lnav documentation for more details.
3. multitail: Display Multiple Logs Side by Side
Best for: Watching several log files simultaneously in separate terminal panels.
multitail is designed to display multiple log files in separate terminal windows or panels. It can also colorize output, filter messages, and help you monitor several streams at once.
For example, you could monitor an application log and an error log side by side:
bash
multitail /var/log/syslog /var/log/auth.log
For remote logs, use SSH to stream the files into multitail:
bash
multitail \
-l “ssh server1 ‘tail -F /var/log/syslog'” \
-l “ssh server2 ‘tail -F /var/log/syslog'”
The -l option runs a command and displays its output in a panel. Exact behavior and available options can vary by multitail version, so consult its manual if you need more advanced layouts.
This arrangement lets you watch multiple remote servers without opening a separate terminal window for every connection.
Example Use Cases
• Monitor application errors on two web servers.
• Compare authentication logs across multiple machines.
• Watch application and database logs at the same time.
• Observe the effects of a deployment across several servers.
Advantages
• Multiple independent panels.
• Easy to see which server generated a message.
• Useful for real-time troubleshooting.
• Supports command output, not just local files.
Disadvantages
• Terminal space becomes limited when monitoring many logs.
• Separate SSH connections must be managed.
• It does not provide centralized long-term log storage or indexing.
If your main requirement is a side-by-side terminal interface, multitail is one of the first tools worth trying.
4. tmux: Build Your Own Multi-Server Log Dashboard
Best for: Administrators who want a flexible terminal dashboard without adopting a dedicated log viewer.
tmux is not a log-monitoring tool itself, but it allows you to create persistent terminal sessions divided into multiple panes.
For example:
bash
tmux new-session -s logs
Run the first remote log command:
bash
ssh server1 ‘tail -F /var/log/syslog’
Split the terminal vertically using Ctrl+B, followed by %, and start another command:
bash
ssh server2 ‘tail -F /var/log/syslog’
You can continue splitting panes to monitor more servers or different log files.
This approach is particularly useful if you want to combine log monitoring with other administrative tasks, such as checking service status or running diagnostic commands.
For repeated use, create a tmux configuration or startup script that opens the required panes automatically.
For example, a simple script could create two panes:
bash
#!/usr/bin/env bash
tmux new-session -d -s logs \
“ssh server1 ‘tail -F /var/log/syslog'”
tmux split-window -h \
“ssh server2 ‘tail -F /var/log/syslog'”
tmux select-layout tiled
tmux attach-session -t logs
This example assumes the session does not already exist and that SSH authentication is configured. You can extend it with additional panes as required.
Unlike a specialized log viewer, tmux does not automatically combine messages by timestamp or understand their structure. Its strength is flexibility.
5. Centralized Logging: When You Have Many Servers
If you routinely monitor logs from dozens or hundreds of machines, opening separate SSH sessions may stop being practical.
A centralized logging system can collect logs from multiple servers and provide a searchable interface, filtering, dashboards, and historical analysis.
Common options include:
• Grafana Loki: A log aggregation system commonly used with Grafana dashboards.
• Elastic Stack: A searchable logging platform with indexing and visualization capabilities.
• Splunk: A platform for collecting, searching, and analyzing machine data.
These systems require more setup than a shell script or terminal utility, but they provide benefits that SSH-based tools do not:
• Persistent log storage.
• Cross-server searching.
• Centralized dashboards.
• Alerts and notifications.
• Historical investigation of events that happened hours or days earlier.
For temporary troubleshooting, SSH-based tools are often simpler. For operational monitoring across a larger infrastructure, centralized logging is usually the more scalable approach.
6. Which Tool Should You Choose?
The following comparison summarizes the main differences between the available tools.
Tool Remote SSH Logs Multiple Logs Side by Side Best Use
SSH + tail -F Yes No, not by itself Simple remote monitoring
lnav Yes Unified timeline Search and analyze logs
multitail Yes, through remote commands Yes Live multi-panel monitoring
tmux Yes, through separate sessions Yes Custom terminal dashboards
Centralized Logging Through agents or collectors Dashboard-based Large environments
Each solution serves a different purpose. The best choice depends on the number of servers, the number of log files being monitored, and whether you need a simple live display or a more comprehensive analysis environment.
Conclusion
There are several good solutions for following remote Linux logs without repeatedly logging into each server manually.
For the command you originally described, a small taillog wrapper around SSH and tail -F is the simplest option:
bash
taillog server_host /var/log/syslog
If you want a richer interactive log viewer with remote access and searching, lnav is an excellent choice.
If you specifically want to display several logs side by side, multitail or tmux is a better fit.
And if you need to investigate events across a large number of servers over time, consider centralized logging with Grafana Loki or the Elastic Stack.
For a small infrastructure, I would start with SSH plus tail -F, then try lnav for analysis or multitail for separate panels if you need more functionality.