I am using putty to connecto to my ubuntu and watch the logs. There is some device which is remotely sending logs to there using syslogd remote facility.

tail -f /var/log/messages

This will show logs, however there are no carriage returns from the logs of that particular device, only ^M. So the question - is there any way to make tail or other utility which is able to follow stream, to convert ^M to CR/LF?

Sample line:

ccc-2e893c98@^M CSeq: 24558 REGISTER^M Max-Forwards: 70^M Contact: acid <sip:
  • Do the messages actually show a ^M or #015, or do they just get printed on the same line? – grawity Feb 10 '12 at 14:32
  • Yes, it shows ^M literally – Pablo Feb 10 '12 at 14:33

^M, or 015, is a "CR" in ASCII. What you're missing is linefeeds (^J 012).

However, it is unusual for syslog output to use CRs like that. Logging over the network does not use any particular line endings – the client is required to send one message per UDP datagram, or to explicitly specify the message length when using stream transports. The messages only get line separators added when they're written out to /var/log, so if your /var/log/messages were lacking LFs, it would be your syslogd that was broken.

But that is not the case, since you say in your comment that "it shows ^M literally". tail does not translate CRs to ^M, it just dumps data to stdout. Instead, it could be that your device does send multiple lines per datagram, and your syslog daemon translates them to a literal ^ + M sequence when writing the log files. (I have rsyslogd here, it converts a CR to #015.)

In other words, your device does not follow the syslog protocol.

You can use the following to convert such a "^M" sequence to a real Unix newline (a LF):

sed 's/\^M/\n/g'

(If you want CR+LF's, use \r\n.)


If you want it to properly see line breaks the most obvious way to me is:

tail -f /var/log/messages | tr '\r' '\n'

If you really want a CRLF, though, you could use sed:

tail -f /var/log/messages | sed -e 's/\r/\r\n/g'


If ^M is the character ^ then M try:

tail -f /var/log/messages | sed -e 's/\^M/\n/g'
  • Doesn't work, still I can see ^M literal in the stream. – Pablo Feb 10 '12 at 14:27
  • tail -f /var/log/messages | tr '^M' '\r\n' this will eat M at the beginning of the line. But will do most of the job. – Pablo Feb 10 '12 at 14:32
  • Did you include the quotes when you ran it? I guess the questino is if this is literally ^M (the character ^ then M) or the single character '^M (a carriage return) – FatalError Feb 10 '12 at 14:34
  • Yes I did. My previous comment shows exactly how I tried. – Pablo Feb 10 '12 at 14:35
  • Updated question with sample line. – Pablo Feb 10 '12 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.