What is this?
lnav is a log file viewer for the terminal. Point it at files or directories and it detects their formats, merges them into a single view ordered by time, and keeps tailing them as new messages arrive.
lnav is a log file viewer for the terminal. Point it at files or directories and it detects their formats, merges them into a single view ordered by time, and keeps tailing them as new messages arrive.How is it different from just using tail, grep or less?Those tools only process raw text lines, while lnav understands log messages. Tail won't show messages in time order or scroll backwards, grep won't return full multi-line messages, less shows one file at a time, and none of them handle compressed files.
Those tools only process raw text lines, while lnav understands log messages. Tail won't show messages in time order or scroll backwards, grep won't return full multi-line messages, less shows one file at a time, and none of them handle compressed files.How do I install and start it?Download a statically-linked binary for Linux, MacOS or Windows from the release page, or use Brew on MacOS. Then just run 'lnav' on the files or directories to monitor — the TUI opens and starts indexing right away.
Download a statically-linked binary for Linux, MacOS or Windows from the release page, or use Brew on MacOS. Then just run 'lnav' on the files or directories to monitor — the TUI opens and starts indexing right away.Do I need to install anything else to get it running?No — the release binaries are statically linked and run standalone. If you build from source instead, you need a C++14 compiler, libpcre2, SQLite 3.9+, zlib, bzip2, libcurl 7.23+, libarchive, libunistring, tshark, and cargo/Rust for the PRQL compiler.
No — the release binaries are statically linked and run standalone. If you build from source instead, you need a C++14 compiler, libpcre2, SQLite 3.9+, zlib, bzip2, libcurl 7.23+, libarchive, libunistring, tshark, and cargo/Rust for the PRQL compiler.Will every file I open show up in the log view?Only files whose messages lnav recognizes appear in the LOG view. Files without recognizable log messages are still visible in the separate TEXT view — press t to reach it.
Only files whose messages lnav recognizes appear in the LOG view. Files without recognizable log messages are still visible in the separate TEXT view — press t to reach it.Does lnav send any data over the network?According to its code signing policy, no — it will not transfer information to other networked systems unless the user or installer specifically requests it.
According to its code signing policy, no — it will not transfer information to other networked systems unless the user or installer specifically requests it.What can I actually do inside the lnav view?Jump to the previous or next error with e/E, search with regular expressions via /, filter or highlight messages with regexes, press P to pretty-print structured text like JSON-lines, and press i for a histogram of messages over time.
Jump to the previous or next error with e/E, search with regular expressions via /, filter or highlight messages with regexes, press P to pretty-print structured text like JSON-lines, and press i for a histogram of messages over time.Can I analyze my logs with SQL?Yes — SQLite is built in. Press ; in the TUI to run queries against the indexed messages, and message filters can also use SQLite expressions instead of plain regular expressions.
Yes — SQLite is built in. Press ; in the TUI to run queries against the indexed messages, and message filters can also use SQLite expressions instead of plain regular expressions.Can I try lnav before installing it?Yes, over SSH. 'ssh [email protected]' starts lnav with a couple of example log files, and 'ssh [email protected]' runs an interactive tutorial teaching the basics of operation.
Yes, over SSH. 'ssh [email protected]' starts lnav with a couple of example log files, and 'ssh [email protected]' runs an interactive tutorial teaching the basics of operation.Does it work with systemd-journald logs?Yes — lnav can serve as the pager for journalctl, including follow mode, and journalctl's JSON output gives it extra fields like PRIORITY. On long-running systems, limit the input (e.g. --since or -b) for efficiency.
Yes — lnav can serve as the pager for journalctl, including follow mode, and journalctl's JSON output gives it extra fields like PRIORITY. On long-running systems, limit the input (e.g. --since or -b) for efficiency.Which topics is it in?less, logging, tui, sysadmin, observability, json, bsd, sqlite, cpp, c++, monitoring, command-line
less, logging, tui, sysadmin, observability, json, bsd, sqlite, cpp, c++, monitoring, command-line