Go to file
2021-01-23 13:36:22 -08:00
.github/workflows [build] try to dump error log 2020-12-10 21:42:44 -08:00
cmake [cmake] enable jit for libpcre 2019-07-15 23:04:31 -07:00
docs [formats] add w3c extended log format impl 2020-12-05 21:51:46 -08:00
example-scripts Example clipboard handler for Linux and WSL 2019-04-24 23:11:25 -06:00
ext add pcapplusplus submodule 2017-04-15 07:05:44 -07:00
m4 [autoconf] check for libarchive 2020-10-20 22:53:59 -07:00
release [release] add xz/lzma to the release build 2021-01-11 21:33:28 -08:00
src [injector] fix some init issues 2021-01-23 13:36:22 -08:00
test [services] initial pass at injecting services and a bunch of other stuff 2021-01-23 13:00:51 -08:00
.cirrus.yml [cirrus/ci] Use a recent FreeBSD image 2020-09-18 16:38:10 -07:00
.gitignore [.gitignore] add cmake-build 2020-04-20 21:22:51 -07:00
.gitmodules use https for submodule 2017-04-15 07:08:33 -07:00
appveyor.yml Add cygwin continuous integration through appveyor 2016-05-31 10:18:37 -03:00
AUTHORS [AUTHORS] Update the file. 2020-09-19 16:22:30 -07:00
autogen.sh [autogen] More fixes. 2015-04-06 00:07:07 -07:00
CMakeLists.txt [archive] remove old unpacked archives and a bunch of other stuff 2021-01-16 22:23:20 -08:00
configure.ac [tests] add a test for decompression 2021-01-10 22:04:55 -08:00
FUNDING.yml Create FUNDING.yml 2020-06-12 14:15:23 -07:00
INSTALL first commit 2009-09-13 18:07:32 -07:00
LICENSE add license 2010-01-16 20:54:22 -08:00
lnav.1 Fix typo in manfile 2019-10-23 22:31:08 +02:00
lnav.cfg [cleanup] uncrustify 2013-06-15 18:07:50 -07:00
Makefile.am [release] add a log generator for demo purposes 2014-03-21 21:18:54 -07:00
NEWS [files] use libarchive to decompress files 2021-01-10 13:33:20 -08:00
README [highlights] allow the highlight color to be specified in log formats 2017-12-29 06:51:09 -08:00
README.md Update README.md 2020-12-27 21:20:58 -08:00
snapcraft.yaml [snap] nope... 2020-09-23 23:35:13 -07:00
TESTS_ENVIRONMENT.in [tests] add a test for decompression 2021-01-10 22:04:55 -08:00

Build Status Build status lnav LoC.

This is the source repository for lnav, visit http://lnav.org for a high level overview.

LNAV -- The Logfile Navigator

The Log File Navigator, lnav for short, is an advanced log file viewer for the small-scale. It is a terminal application that can understand your log files and make it easy for you to find problems with little to no setup.

Contributing

Features

  • Log messages from different files are collated together into a single view
  • Automatic detection of log format
  • Automatic decompression of GZip and BZip2 files
  • Filter log messages based on regular expressions
  • Use SQL to analyze your logs
  • And more...

Prerequisites

The following software packages are required to build lnav:

  • gcc/clang - A C++14-compatible compiler.
  • libpcre - The Perl Compatible Regular Expression (PCRE) library.
  • sqlite - The SQLite database engine. Version 3.9.0 or higher is required.
  • ncurses - The ncurses text UI library.
  • readline - The readline line editing library.
  • zlib - The zlib compression library.
  • bz2 - The bzip2 compression library.
  • libcurl - The cURL library for downloading files from URLs. Version 7.23.0 or higher is required.

Installation

Lnav follows the usual GNU style for configuring and installing software:

Run ./autogen.sh if compiling from a cloned repository.

$ ./configure
$ make
$ sudo make install

Cygwin users

It should compile fine in Cygwin.

Alternatively, you can get the generated binary from AppVeyor artifacts.

Remember that you still need the lnav dependencies under Cygwin, here is a quick way to do it:

setup-x86_64.exe -q -P libpcre1 -P libpcrecpp0 -P libsqlite3_0 -P libstdc++6

Currently, the x64 version seems to be working better than the x86 one.

Usage

The only file installed is the executable, lnav. You can execute it with no arguments to view the default set of files:

$ lnav

You can view all the syslog messages by running:

$ lnav /var/log/messages*

Usage with systemd-journald

On systems running systemd-journald, you can use lnav as the pager:

$ journalctl | lnav

or in follow mode:

$ journalctl -f | lnav

Since journalctl's default output format omits the year, if you are viewing logs which span multiple years you will need to change the output format to include the year, otherwise lnav gets confused:

$ journalctl -o short-iso | lnav

It is also possible to use journalctl's json output format and lnav will make use of additional fields such as PRIORITY and _SYSTEMD_UNIT:

$ journalctl -o json | lnav

In case some MESSAGE fields contain special characters such as ANSI color codes which are considered as unprintable by journalctl, specifying journalctl's -a option might be preferable in order to output those messages still in a non binary representation:

$ journalctl -a -o json | lnav

If using systemd v236 or newer, the output fields can be limited to the ones actually recognized by lnav for increased efficiency:

$ journalctl -o json --output-fields=MESSAGE,PRIORITY,_PID,SYSLOG_IDENTIFIER,_SYSTEMD_UNIT | lnav

If your system has been running for a long time, for increased efficiency you may want to limit the number of log lines fed into lnav, e.g. via journalctl's -n or --since=... options.

In case of a persistent journal, you may want to limit the number of log lines fed into lnav via journalctl's -b option.

Screenshot

The following screenshot shows a syslog file. Log lines are displayed with highlights. Errors are red and warnings are yellow.

Screenshot

See Also

Angle-grinder is a tool to slice and dice log files on the command-line. If you're familiar with the SumoLogic query language, you might find this tool more comfortable to work with.