Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using putty to connecto to my ubuntu and watch the logs. There is some device which is remotely sending logs to there using syslogd remote facility.

tail -f /var/log/messages

This will show logs, however there are no carriage returns from the logs of that particular device, only ^M. So the question - is there any way to make tail or other utility which is able to follow stream, to convert ^M to CR/LF?

Sample line:

ccc-2e893c98@^M CSeq: 24558 REGISTER^M Max-Forwards: 70^M Contact: acid <sip:
share|improve this question
Do the messages actually show a ^M or #015, or do they just get printed on the same line? – grawity Feb 10 '12 at 14:32
Yes, it shows ^M literally – Pablo Feb 10 '12 at 14:33
up vote 1 down vote accepted

^M, or 015, is a "CR" in ASCII. What you're missing is linefeeds (^J 012).

However, it is unusual for syslog output to use CRs like that. Logging over the network does not use any particular line endings – the client is required to send one message per UDP datagram, or to explicitly specify the message length when using stream transports. The messages only get line separators added when they're written out to /var/log, so if your /var/log/messages were lacking LFs, it would be your syslogd that was broken.

But that is not the case, since you say in your comment that "it shows ^M literally". tail does not translate CRs to ^M, it just dumps data to stdout. Instead, it could be that your device does send multiple lines per datagram, and your syslog daemon translates them to a literal ^ + M sequence when writing the log files. (I have rsyslogd here, it converts a CR to #015.)

In other words, your device does not follow the syslog protocol.

You can use the following to convert such a "^M" sequence to a real Unix newline (a LF):

sed 's/\^M/\n/g'

(If you want CR+LF's, use \r\n.)

share|improve this answer

If you want it to properly see line breaks the most obvious way to me is:

tail -f /var/log/messages | tr '\r' '\n'

If you really want a CRLF, though, you could use sed:

tail -f /var/log/messages | sed -e 's/\r/\r\n/g'


If ^M is the character ^ then M try:

tail -f /var/log/messages | sed -e 's/\^M/\n/g'
share|improve this answer
Doesn't work, still I can see ^M literal in the stream. – Pablo Feb 10 '12 at 14:27
tail -f /var/log/messages | tr '^M' '\r\n' this will eat M at the beginning of the line. But will do most of the job. – Pablo Feb 10 '12 at 14:32
Did you include the quotes when you ran it? I guess the questino is if this is literally ^M (the character ^ then M) or the single character '^M (a carriage return) – FatalError Feb 10 '12 at 14:34
Yes I did. My previous comment shows exactly how I tried. – Pablo Feb 10 '12 at 14:35
Updated question with sample line. – Pablo Feb 10 '12 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .