How to make tail to convert ^M into CR?

Question

I am using putty to connecto to my ubuntu and watch the logs. There is some device which is remotely sending logs to there using syslogd remote facility.

tail -f /var/log/messages

This will show logs, however there are no carriage returns from the logs of that particular device, only ^M. So the question - is there any way to make tail or other utility which is able to follow stream, to convert ^M to CR/LF?

Sample line:

ccc-2e893c98@192.168.1.13^M CSeq: 24558 REGISTER^M Max-Forwards: 70^M Contact: acid <sip:

Answer 1

^M, or 015, is a "CR" in ASCII. What you're missing is linefeeds (^J 012).

However, it is unusual for syslog output to use CRs like that. Logging over the network does not use any particular line endings – the client is required to send one message per UDP datagram, or to explicitly specify the message length when using stream transports. The messages only get line separators added when they're written out to /var/log, so if your /var/log/messages were lacking LFs, it would be your syslogd that was broken.

But that is not the case, since you say in your comment that "it shows ^M literally". tail does not translate CRs to ^M, it just dumps data to stdout. Instead, it could be that your device does send multiple lines per datagram, and your syslog daemon translates them to a literal ^ + M sequence when writing the log files. (I have rsyslogd here, it converts a CR to #015.)

In other words, your device does not follow the syslog protocol.

You can use the following to convert such a "^M" sequence to a real Unix newline (a LF):

sed 's/\^M/\n/g'

(If you want CR+LF's, use \r\n.)

Answer 2

If you want it to properly see line breaks the most obvious way to me is:

tail -f /var/log/messages | tr '\r' '\n'

If you really want a CRLF, though, you could use sed:

tail -f /var/log/messages | sed -e 's/\r/\r\n/g'

Edit:

If ^M is the character ^ then M try:

tail -f /var/log/messages | sed -e 's/\^M/\n/g'