You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 
Go to file
Tim Stack 53ab7b14a6 [mouse] flesh out things more 19 hours ago
.circleci [circleci] test output 2 weeks ago
.github [bins] add manpage 6 days ago
cmake [pcre2] migrate from pcre to pcre2 2 years ago
demo [build] add --platform to Dockerfiles 10 months ago
docs [mouse] flesh out things more 19 hours ago
example-scripts [mouse] flesh out things more 19 hours ago
ext add pcapplusplus submodule 7 years ago
m4 [build] fix for autoconf screwing up the c++ flags 2 months ago
release [exec] missed creating workdir 1 week ago
src [mouse] flesh out things more 19 hours ago
test [mouse] flesh out things more 19 hours ago
tools [build] Use fPIE on bin2c 9 months ago
.cirrus.yml [cirrus] add binary artifact 10 months ago
.clang-format [clang-format] init 2 years ago
.clang-tidy [docs] mention timezone stuff 7 months ago
.codespellrc [build] run cmake-init and switch from hunter to conan for packages 2 years ago
.coveralls.yml [ci] add .coveralls.yml 3 years ago
.gitignore [config] simplify file format detection by moving it into the log format definition 9 months ago
.gitmodules use https for submodule 7 years ago
.readthedocs.yaml [readthedocs] fix python version 8 months ago
ARCHITECTURE.md [docs] update links from lnav.readthedocs.io to docs.lnav.org 2 years ago
AUTHORS [blog] add post for cursor mode 10 months ago
CMakeLists.txt [exec] missed creating workdir 1 week ago
CMakePresets.json [build] run cmake-init and switch from hunter to conan for packages 2 years ago
CMakeUserPresets.json.example [cmake] add user preset example 2 years ago
FUNDING.yml Create FUNDING.yml 4 years ago
INSTALL first commit 15 years ago
LICENSE add license 14 years ago
Makefile.am [build] add schemas to dist 2 weeks ago
NEWS.md [mouse] flesh out things more 19 hours ago
README [readme] mention running autogen.sh in the regular README 2 years ago
README.md [prql] use cxx for rust ffi stuff 2 weeks ago
TESTS_ENVIRONMENT.in [tests] scrub out $UID in test output 9 months ago
appveyor.yml [appveyor] remove x86 build 10 months ago
autogen.sh [autogen] More fixes. 9 years ago
cleanup_expected.sh [regex101] add an integration with regex101 2 years ago
conanfile.py [prql] initial work for integrating PRQL 3 weeks ago
configure.ac [exec] missed creating workdir 1 week ago
lnav.1 [bins] add manpage 6 days ago
lnav.cfg [cleanup] uncrustify 11 years ago
snapcraft.yaml [prql] use cxx for rust ffi stuff 2 weeks ago
update_expected_output.sh [date_time_scanner] do not try to read millis if it is already set 8 months ago

README.md

Build Docs Coverage Status lnav

Discord Logo

This is the source repository for lnav, visit https://lnav.org for a high level overview.

LNAV -- The Logfile Navigator

The Logfile Navigator is a log file viewer for the terminal. Given a set of files/directories, lnav will:

  • decompress as needed;
  • detect their format;
  • merge the files together by time into a single view;
  • tail the files, follow renames, find new files in directories;
  • build an index of errors and warnings;
  • pretty-print JSON-lines.

Then, in the lnav TUI, you can:

Screenshot

The following screenshot shows a mix of syslog and web access log files. Failed requests are shown in red. Identifiers, like IP address and PIDs are semantically highlighted.

Screenshot

Why not just use tail/grep/less?

The standard Unix utilities are great for processing raw text lines, however, they do not understand log messages. Tail can watch multiple files at a time, but it won't display messages in order by time and you can't scroll backwards. Grep will only find matching lines, but won't return a full multi-line log message. Less can only display a single file at a time. Also, none of these basic tools handle compressed files.

Try online before installing

You can SSH into a demo node to play with lnav before installing.

The "playground" account starts lnav with a couple of log files as an example:

$ ssh playground@demo.lnav.org

The "tutorial 1" account is an interactive tutorial that can teach you the basics of operation:

$ ssh tutorial1@demo.lnav.org

Installation

Download a statically-linked binary for Linux/MacOS from the release page

Brew on MacOS

$ brew install lnav

Usage

Simply point lnav at the files or directories you want to monitor, it will figure out the rest:

$ lnav /path/to/file1 /path/to/dir ...

The lnav TUI will pop up right away and begin indexing the files. Progress is displayed in the "Files" panel at the bottom. Once the indexing has finished, the LOG view will display the log messages that were recognized1. You can then use the usual hotkeys to move around the view (arrow keys or j/k/h/l to move down/up/left/right).

See the Usage section of the online documentation for more information.

Usage with systemd-journald

On systems running systemd-journald, you can use lnav as the pager:

$ journalctl | lnav

or in follow mode:

$ journalctl -f | lnav

Since journalctl's default output format omits the year, if you are viewing logs which span multiple years you will need to change the output format to include the year, otherwise lnav gets confused:

$ journalctl -o short-iso | lnav

It is also possible to use journalctl's json output format and lnav will make use of additional fields such as PRIORITY and _SYSTEMD_UNIT:

$ journalctl -o json | lnav

In case some MESSAGE fields contain special characters such as ANSI color codes which are considered as unprintable by journalctl, specifying journalctl's -a option might be preferable in order to output those messages still in a non-binary representation:

$ journalctl -a -o json | lnav

If using systemd v236 or newer, the output fields can be limited to the ones actually recognized by lnav for increased efficiency:

$ journalctl -o json --output-fields=MESSAGE,PRIORITY,_PID,SYSLOG_IDENTIFIER,_SYSTEMD_UNIT | lnav

If your system has been running for a long time, for increased efficiency you may want to limit the number of log lines fed into lnav, e.g. via journalctl's -n or --since=... options.

In case of a persistent journal, you may want to limit the number of log lines fed into lnav via journalctl's -b option.

Support

Please file issues on this repository or use the discussions section. The following alternatives are also available:

Contributing

Building From Source

Prerequisites

The following software packages are required to build lnav:

  • gcc/clang - A C++14-compatible compiler.
  • libpcre2 - The Perl Compatible Regular Expression v2 (PCRE2) library.
  • sqlite - The SQLite database engine. Version 3.9.0 or higher is required.
  • ncurses - The ncurses text UI library.
  • readline - The readline line editing library.
  • zlib - The zlib compression library.
  • bz2 - The bzip2 compression library.
  • libcurl - The cURL library for downloading files from URLs. Version 7.23.0 or higher is required.
  • libarchive - The libarchive library for opening archive files, like zip/tgz.
  • wireshark - The 'tshark' program is used to interpret pcap files.
  • cargo/rust - The Rust language is used to build the PRQL compiler.

Build

Lnav follows the usual GNU style for configuring and installing software:

Run ./autogen.sh if compiling from a cloned repository.

$ ./configure
$ make
$ sudo make install

See Also

Angle-grinder is a tool to slice and dice log files on the command-line. If you're familiar with the SumoLogic query language, you might find this tool more comfortable to work with.


  1. Files that do not contain log messages can be seen in the TEXT view (reachable by pressing t). ↩︎