The log file navigator, lnav, is an enhanced log file viewer that takes advantage of any semantic information that can be gleaned from the files being viewed, such as timestamps and log levels. Using this extra semantic information, lnav can do things like interleaving messages from different files, generate histograms of messages over time, and providing hotkeys for navigating through the file. It is hoped that these features will allow the user to quickly and efficiently zero in on problems.
The following software packages are required to build lnav:
- gcc/clang - A C++14-compatible compiler.
- libpcre - The Perl Compatible Regular Expression (PCRE) library.
- sqlite - The SQLite database engine. Version 3.9.0 or higher is required.
- ncurses - The ncurses text UI library.
- readline - The readline line editing library.
- zlib - The zlib compression library.
- bz2 - The bzip2 compression library.
- libcurl - The cURL library for downloading files from URLs. Version 7.23.0 or higher is required.
Lnav follows the usual GNU style for configuring and installing software:
$ sudo make install
./autogen.shbefore running any of the above commands when compiling from a cloned repository.
It should compile fine in Cygwin.
Alternatively, you can get the generated binary from AppVeyor artifacts.
Remember that you still need the lnav dependencies under Cygwin, here is a quick way to do it:
setup-x86_64.exe -q -P libpcre1 -P libpcrecpp0 -P libsqlite3_0 -P libstdc++6Currently, the x64 version seems to be working better than the x86 one.
The only file installed is the executable,
lnav. You can execute it with no arguments to view the default set of files:
$ lnavYou can view all the syslog messages by running:
$ lnav /var/log/messages*
On systems running
systemd-journald, you can use
lnavas the pager:
$ journalctl | lnavor in follow mode:
$ journalctl -f | lnavSince
journalctl's default output format omits the year, if you are viewing logs which span multiple years you will need to change the output format to include the year, otherwise
$ journalctl -o short-iso | lnavIt is also possible to use
journalctl's json output format and
lnavwill make use of additional fields such as PRIORITY and _SYSTEMD_UNIT:
$ journalctl -o json | lnavIn case some MESSAGE fields contain special characters such as ANSI color codes which are considered as unprintable by journalctl, specifying
-aoption might be preferable in order to output those messages still in a non binary representation:
$ journalctl -a -o json | lnavIf using systemd v236 or newer, the output fields can be limited to the ones actually recognized by
lnavfor increased efficiency:
$ journalctl -o json --output-fields=MESSAGE,PRIORITY,_PID,SYSLOG_IDENTIFIER,_SYSTEMD_UNIT | lnavIf your system has been running for a long time, for increased efficiency you may want to limit the number of log lines fed into
lnav, e.g. via
In case of a persistent journal, you may want to limit the number of log lines fed into
The lnav website can be found at:
Angle-grinder is a tool to slice and dice log files on the command-line. If you're familiar with the SumoLogic query language, you might find this tool more comfortable to work with.