mirror of
https://github.com/tstack/lnav
synced 2024-11-17 15:29:40 +00:00
5.3 KiB
5.3 KiB
Screenshot
The following screenshot shows a syslog file. Log lines are displayed
with highlights. Errors are red and warnings are yellow.
Screenshot[1][2]
▌[1] - file://{top_srcdir}/docs/assets/images/lnav-syslog-thumb.png
▌[2] - file://{top_srcdir}/docs/assets/images/lnav-syslog.png
Features
• Log messages from different files are collated together
into a single view
• Automatic detection of log format
• Automatic decompression of GZip and BZip2 files
• Filter log messages based on regular expressions
• Use SQL to analyze your logs
• And more...
Installation
Download a statically-linked binary for Linux/MacOS from the release
page[1]
▌[1] - https://github.com/tstack/lnav/releases/latest#release-artifacts
Usage
The only file installed is the executable, lnav . You can execute it
with no arguments to view the default set of files:
▌$ lnav
You can view all the syslog messages by running:
▌$ lnav /var/log/messages*
Usage with systemd-journald
On systems running systemd-journald , you can use lnav as the
pager:
▌$ journalctl | lnav
or in follow mode:
▌$ journalctl -f | lnav
Since journalctl 's default output format omits the year, if you are
viewing logs which span multiple years you will need to change the
output format to include the year, otherwise lnav gets confused:
▌$ journalctl -o short-iso | lnav
It is also possible to use journalctl 's json output format and lnav
will make use of additional fields such as PRIORITY and _SYSTEMD_UNIT:
▌$ journalctl -o json | lnav
In case some MESSAGE fields contain special characters such as ANSI
color codes which are considered as unprintable by journalctl,
specifying journalctl 's -a option might be preferable in order to
output those messages still in a non-binary representation:
▌$ journalctl -a -o json | lnav
If using systemd v236 or newer, the output fields can be limited to
the ones actually recognized by lnav for increased efficiency:
▌$ journalctl -o json --output-fields=MESSAGE,PRIORITY,_PID,SYSLOG_IDENTIFIER,_SYSTEMD_UNIT | lnav
If your system has been running for a long time, for increased
efficiency you may want to limit the number of log lines fed into lnav
, e.g. via journalctl 's -n or --since=... options.
In case of a persistent journal, you may want to limit the number of
log lines fed into lnav via journalctl 's -b option.
Support
Please file issues on this repository or use the discussions section.
The following alternatives are also available:
• support@lnav.org[1]
• Discord[2]
• Google Groups[3]
▌[1] - mailto:support@lnav.org
▌[2] - https://discord.gg/erBPnKwz7R
▌[3] - https://groups.google.com/g/lnav
Links
• Main Site[1]
• Documentation[2] on Read the Docs
• Internal Architecture[3]
▌[1] - https://lnav.org
▌[2] - https://docs.lnav.org
▌[3] - file://{top_srcdir}/ARCHITECTURE.md
Contributing
• Become a Sponsor on GitHub[1]
▌[1] - https://github.com/sponsors/tstack
Building From Source
Prerequisites
The following software packages are required to build lnav:
• gcc/clang - A C++14-compatible compiler.
• libpcre2 - The Perl Compatible Regular Expression v2
(PCRE2) library.
• sqlite - The SQLite database engine. Version 3.9.0
or higher is required.
• ncurses - The ncurses text UI library.
• readline - The readline line editing library.
• zlib - The zlib compression library.
• bz2 - The bzip2 compression library.
• libcurl - The cURL library for downloading files
from URLs. Version 7.23.0 or higher is required.
• libarchive - The libarchive library for opening archive
files, like zip/tgz.
• wireshark - The 'tshark' program is used to interpret
pcap files.
Build
Lnav follows the usual GNU style for configuring and installing
software:
Run ./autogen.sh if compiling from a cloned repository.
▌$ ./configure
▌$ make
▌$ sudo make install
See Also
Angle-grinder[1] is a tool to slice and dice log files on the
command-line. If you're familiar with the SumoLogic query language,
you might find this tool more comfortable to work with.
▌[1] - https://github.com/rcoh/angle-grinder
The following screenshot shows a syslog file. Log lines are displayed
with highlights. Errors are red and warnings are yellow.
Screenshot[1][2]
▌[1] - file://{top_srcdir}/docs/assets/images/lnav-syslog-thumb.png
▌[2] - file://{top_srcdir}/docs/assets/images/lnav-syslog.png
Features
• Log messages from different files are collated together
into a single view
• Automatic detection of log format
• Automatic decompression of GZip and BZip2 files
• Filter log messages based on regular expressions
• Use SQL to analyze your logs
• And more...
Installation
Download a statically-linked binary for Linux/MacOS from the release
page[1]
▌[1] - https://github.com/tstack/lnav/releases/latest#release-artifacts
Usage
The only file installed is the executable, lnav . You can execute it
with no arguments to view the default set of files:
▌$ lnav
You can view all the syslog messages by running:
▌$ lnav /var/log/messages*
Usage with systemd-journald
On systems running systemd-journald , you can use lnav as the
pager:
▌$ journalctl | lnav
or in follow mode:
▌$ journalctl -f | lnav
Since journalctl 's default output format omits the year, if you are
viewing logs which span multiple years you will need to change the
output format to include the year, otherwise lnav gets confused:
▌$ journalctl -o short-iso | lnav
It is also possible to use journalctl 's json output format and lnav
will make use of additional fields such as PRIORITY and _SYSTEMD_UNIT:
▌$ journalctl -o json | lnav
In case some MESSAGE fields contain special characters such as ANSI
color codes which are considered as unprintable by journalctl,
specifying journalctl 's -a option might be preferable in order to
output those messages still in a non-binary representation:
▌$ journalctl -a -o json | lnav
If using systemd v236 or newer, the output fields can be limited to
the ones actually recognized by lnav for increased efficiency:
▌$ journalctl -o json --output-fields=MESSAGE,PRIORITY,_PID,SYSLOG_IDENTIFIER,_SYSTEMD_UNIT | lnav
If your system has been running for a long time, for increased
efficiency you may want to limit the number of log lines fed into lnav
, e.g. via journalctl 's -n or --since=... options.
In case of a persistent journal, you may want to limit the number of
log lines fed into lnav via journalctl 's -b option.
Support
Please file issues on this repository or use the discussions section.
The following alternatives are also available:
• support@lnav.org[1]
• Discord[2]
• Google Groups[3]
▌[1] - mailto:support@lnav.org
▌[2] - https://discord.gg/erBPnKwz7R
▌[3] - https://groups.google.com/g/lnav
Links
• Main Site[1]
• Documentation[2] on Read the Docs
• Internal Architecture[3]
▌[1] - https://lnav.org
▌[2] - https://docs.lnav.org
▌[3] - file://{top_srcdir}/ARCHITECTURE.md
Contributing
• Become a Sponsor on GitHub[1]
▌[1] - https://github.com/sponsors/tstack
Building From Source
Prerequisites
The following software packages are required to build lnav:
• gcc/clang - A C++14-compatible compiler.
• libpcre2 - The Perl Compatible Regular Expression v2
(PCRE2) library.
• sqlite - The SQLite database engine. Version 3.9.0
or higher is required.
• ncurses - The ncurses text UI library.
• readline - The readline line editing library.
• zlib - The zlib compression library.
• bz2 - The bzip2 compression library.
• libcurl - The cURL library for downloading files
from URLs. Version 7.23.0 or higher is required.
• libarchive - The libarchive library for opening archive
files, like zip/tgz.
• wireshark - The 'tshark' program is used to interpret
pcap files.
Build
Lnav follows the usual GNU style for configuring and installing
software:
Run ./autogen.sh if compiling from a cloned repository.
▌$ ./configure
▌$ make
▌$ sudo make install
See Also
Angle-grinder[1] is a tool to slice and dice log files on the
command-line. If you're familiar with the SumoLogic query language,
you might find this tool more comfortable to work with.
▌[1] - https://github.com/rcoh/angle-grinder