README

_This is the source repository for lnav, visit https://lnav.org for a high level overview._

 LNAV -- The Logfile Navigator

The Logfile Navigator is a log file viewer for the terminal.  Given a
set of files/directories, lnav will:

- decompress as needed;
- detect their format;
- merge the files by time into a single view;
- tail the files, follow renames, find new files in directories;
- build an index of errors and warnings;
- pretty-print JSON-lines.

Then, in the lnav TUI, you can:

- jump quickly to the previous/next error (press e/E);
- search using regular expressions (press /);
- highlight text with a regular expression (:highlight command);
- filter messages using regular expressions or SQLite expressions;
- pretty-print structured text (press P);
- view a histogram of messages over time (press i);
- analyze messages using SQLite (press ;)

 Screenshot

The following screenshot shows a mix of syslog and web access log
files.  Failed requests are shown in red.  Identifiers, like IP
address and PIDs are semantically highlighted.



 Why not just use tail/grep/less?

The standard Unix utilities are great for processing raw text lines,
however, they do not understand log messages.  Tail can watch
multiple files at a time, but it won't display messages in order by
time and you can't scroll backwards.  Grep will only find matching
lines, but won't return a full multi-line log message.  Less can only
display a single file at a time.  Also, none of these basic tools
handle compressed files.

 Try online before installing

You can SSH into a demo node to play with lnav before installing.

The "playground" account starts lnav with a couple of log files as
an example:

$ ssh [email protected]

The "tutorial 1" account is an interactive tutorial that can teach
you the basics of operation:

$ ssh [email protected]

 Installation

Download a statically-linked binary for Linux/MacOS/Windows from the release page

 Brew on MacOS

console
$ brew install lnav


 FreeBSD

console
$ pkg install lnav


 Usage

Simply point lnav at the files or directories you want to
monitor, it will figure out the rest:

console
$ lnav /path/to/file1 /path/to/dir ...


The lnav TUI will pop up right away and begin indexing the
files. Progress is displayed in the "Files" panel at the
bottom. Once the indexing has finished, the LOG view will display
the log messages that were recognized[^1]. You can then use the
usual hotkeys to move around the view (arrow keys or
j/k/h/l to move down/up/left/right).

See the Usage section
of the online documentation for more information.

[^1]: Files that do not contain log messages can be seen in the
      TEXT view (reachable by pressing t).

 Usage with systemd-journald

On systems running systemd-journald, you can use lnav as the pager:


$ journalctl | lnav


or in follow mode:


$ journalctl -f | lnav


Since journalctl's default output format omits the year, if you are
viewing logs which span multiple years you will need