[opensourcedex]

lnav is a free, open source monitoring & observability project written in C++ and released under BSD-2-Clause. It has 10,675 GitHub stars, 403 forks and 295 open issues, and was last pushed 3 days ago. On this registry it ranks #44 of 97 tracked projects in Monitoring & Observability, with 5 head-to-head comparisons available. It gained 7 stars over the last 3 tracked days.

What is lnav?

lnav is a log file viewer for the terminal that decompresses, detects the format of, merges, indexes and queries log files in one interactive text interface, built for developers, system administrators and support engineers who diagnose systems from the command line.

What it is

lnav is the Logfile Navigator, written in C++ and released under the BSD-2-Clause licence. It lives in the Unix command-line ecosystem as a terminal pager, filed in this registry under Infrastructure & Operations / Monitoring & Observability alongside topics such as tail, less, pager and terminal-pager. Point it at files or directories and it decompresses as needed, detects their formats, merges the files by time into a single view, tails them, follows renames, finds new files in directories, builds an index of errors and warnings, and pretty-prints JSON-lines.

The concrete problem it solves is that the standard Unix utilities do not understand log messages. Tail can watch multiple files at a time, but it will not display messages in order by time and it cannot scroll backwards. Grep returns only matching lines rather than a full multi-line log message. Less displays a single file at a time. None of these tools handles compressed files. lnav replaces that ad hoc tail/grep/less chain with one time-ordered view of many logs that can be searched, filtered and queried as a whole.

Key capabilities

  • Merges multiple files and directories by timestamp into a single LOG view, showing indexing progress in the "Files" panel.
  • Decompresses files automatically, tails them, follows renames and finds new files in watched directories.
  • Jumps to the previous or next error or warning with e and E once the error/warning index is built.
  • Searches with regular expressions using /, and highlights matching text with the :highlight command.
  • Filters messages using regular expressions or SQLite expressions.
  • Runs SQLite queries against log messages with ;, and displays a histogram of message volume over time with i.
  • Pretty-prints structured text with P, including JSON-lines.

Who uses it and how

  • System administrators and support engineers reading mixed logs, such as syslog alongside web access logs, where failed requests are shown in red and identifiers like IP addresses and PIDs are semantically highlighted.
  • Operators working on remote hosts over SSH, because lnav runs entirely in the terminal and needs no graphical session.
  • Users evaluating the tool before installing, using the demo nodes ssh [email protected] for an example session and ssh [email protected] for an interactive tutorial covering the basics of operation.
  • Teams on Linux, macOS, Windows or FreeBSD, installing from the statically linked binaries published on the release page or from platform packages.

Getting started

Install with brew install lnav on macOS, pkg install lnav on FreeBSD, or download a statically linked binary for Linux, macOS or Windows from the release page. Then run lnav /path/to/file1 /path/to/dir ... and the TUI opens and begins indexing.

How it compares

The README positions lnav directly against tail, grep and less, the tools it is meant to replace for log work, because those utilities process raw text lines without understanding log messages. lnav keeps the terminal pager model of less while adding time-ordered merging, compressed-file handling and structured formats that the three utilities handle separately or not at all.

When to use it — and when not to

lnav runs as a single terminal binary, so a self-hoster does not operate a database, storage service or SMTP server to use it, but the interface is keyboard-driven and requires learning — the project supplies interactive tutorial accounts for exactly that reason. It is a poor fit for anyone who needs a graphical dashboard, since all interaction happens in the TUI, and the README defers the high-level overview to lnav.org and detailed documentation to docs.lnav.org rather than covering it in the repository. The repository also carries 295 open issues, and the README excerpt is truncated, so prospective users should check the external documentation for current detail.

project readme (upstream, from github) — read inline

Build Docs Coverage Status lnav Gurubase

Discord Logo

This is the source repository for lnav, visit https://lnav.org for a high level overview.

LNAV -- The Logfile Navigator

The Logfile Navigator is a log file viewer for the terminal. Given a set of files/directories, lnav will:

  • decompress as needed;
  • detect their format;
  • merge the files by time into a single view;
  • tail the files, follow renames, find new files in directories;
  • build an index of errors and warnings;
  • pretty-print JSON-lines.

Then, in the lnav TUI, you can:

Screenshot

The following screenshot shows a mix of syslog and web access log files. Failed requests are shown in red. Identifiers, like IP address and PIDs are semantically highlighted.

Screenshot

Why not just use tail/grep/less?

The standard Unix utilities are great for processing raw text lines, however, they do not understand log messages. Tail can watch multiple files at a time, but it won't display messages in order by time and you can't scroll backwards. Grep will only find matching lines, but won't return a full multi-line log message. Less can only display a single file at a time. Also, none of these basic tools handle compressed files.

Try online before installing

You can SSH into a demo node to play with lnav before installing.

The "playground" account starts lnav with a couple of log files as an example:

$ ssh [email protected]

The "tutorial 1" account is an interactive tutorial that can teach you the basics of operation:

$ ssh [email protected]

Installation

Download a statically-linked binary for Linux/MacOS/Windows from the release page

Brew on MacOS

$ brew install lnav

FreeBSD

$ pkg install lnav

Usage

Simply point lnav at the files or directories you want to monitor, it will figure out the rest:

$ lnav /path/to/file1 /path/to/dir ...

The lnav TUI will pop up right away and begin indexing the files. Progress is displayed in the "Files" panel at the bottom. Once the indexing has finished, the LOG view will display the log messages that were recognized[^1]. You can then use the usual hotkeys to move around the view (arrow keys or j/k/h/l to move down/up/left/right).

See the Usage section of the online documentation for more information.

[^1]: Files that do not contain log messages can be seen in the TEXT view (reachable by pressing t).

Usage with systemd-journald

On systems running systemd-journald, you can use lnav as the pager:

$ journalctl | lnav

or in follow mode:

$ journalctl -f | lnav

Since journalctl's default output format omits the year, if you are viewing logs which span multiple years you will need to change the output format to include the year, otherwise lnav gets confused:

$ journalctl -o short-iso | lnav

It is also possible to use journalctl's json output format and lnav will make use of additional fields such as PRIORITY and _SYSTEMD_UNIT:

$ journalctl -o json | lnav

In case some MESSAGE fields contain special characters such as ANSI color codes which are considered as unprintable by journalctl, specifying journalctl's -a option might be preferable in order to output those messages still in a non-binary representation:

$ journalctl -a -o json | lnav

If using systemd v236 or newer, the output fields can be limited to the ones actually recognized by lnav for increased efficiency:

$ journalctl -o json --output-fields=MESSAGE,PRIORITY,_PID,SYSLOG_IDENTIFIER,_SYSTEMD_UNIT | lnav

If your system has been running for a long time, for increased efficiency you may want to limit the number of log lines fed into lnav, e.g. via journalctl's -n or --since=... options.

In case of a persistent journal, you may want to limit the number of log lines fed into lnav via journalctl's -b option.

Support

Please file issues on this repository or use the discussions section. The following alternatives are also available:

Links

Contributing

Building From Source

Prerequisites

The following software packages are required to build lnav:

  • gcc/clang - A C++14-compatible compiler.
  • libpcre2 - The Perl Compatible Regular Expression v2 (PCRE2) library.
  • sqlite - The SQLite database engine. Version 3.9.0 or higher is required.
  • zlib - The zlib compression library.
  • bz2 - The bzip2 compression library.
  • libcurl - The cURL library for downloading files from URLs. Version 7.23.0 or higher is required.
  • libarchive - The libarchive library for opening archive files, like zip/tgz.
  • libunistring - The libunistring library for dealing with unicode.
  • wireshark - The 'tshark' program is used to interpret pcap files.
  • cargo/rust - The Rust language is used to build the PRQL compiler.
Build

Lnav follows the usual GNU style for configuring and installing software:

Run ./autogen.sh if compiling from a cloned repository.

$ ./configure
$ make
$ sudo make install

See Also

Angle-grinder is a tool to slice and dice log files on the command-line. If you're familiar with the SumoLogic query language, you might find this tool more comfortable to work with.

Code Signing Policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

Acknowledgements

Many thanks to:

  • GitHub Sponsors
  • Anthropic for including lnav in the Claude for Open Source Program

Frequently asked questions

Is lnav free to use?

lnav is open source under the BSD-2-Clause licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does lnav do?

Log file navigator

What is lnav written in?

lnav is primarily written in C++. Its source is publicly available at https://github.com/tstack/lnav, and it has 10,675 GitHub stars.