Automatic Log Format Detection
The log message format is automatically determined by lnav while scanning your files. The following formats are built-in by default:
GZIP’ed and BZIP2’ed files are also detected automatically and decompressed on-the-fly.
Display only lines that match or do not match a set of regular expressions. Useful for removing extraneous log lines that you are not interested in.
The timeline view shows a histogram of messages over time. The number of warnings and errors are highlighted in the display so that you can easily see where problems have occurred. Once you have found a period of time that is of interest, a key-press will take you back to the log message view at the corresponding time.
The pretty-print view will reformat structured data, like XML or JSON, so that it is easier to read. Simply press SHIFT+P in the log view to have all the currently displayed lines pretty-printed.
Query Logs Using SQL
Log files are directly used as the backing for SQLite virtual tables. This means you can perform queries on messages without having to load the data into an SQL database.
Automatic Data Extraction (BETA)
The built-in log message parser can automatically discover and extract interesting data from plainly formatted log messages. For example, the screenshot above shows the key/value pairs extracted from a sudo log message. These pairs can then be accessed using SQL.
Searches are done as you type; new log lines are automatically loaded and searched as they are added; filters apply to lines as they are loaded; and, SQL queries are checked for correctness as you type.
Errors and warnings are colored in red and yellow, respectively. Highlights are also applied to: SQL keywords, XML tags, file and line numbers in Java backtraces, and quoted strings. The search and SQL query prompt are also highlighted as you type, making it easier to see errors and matching brackets.
The command prompt supports tab-completion for almost all operations. For example, when doing a search, you can tab-complete words that are displayed on-screen rather than having to do a copy & paste.
Session information is saved automatically and restored when you are viewing the same set of files. The current location in files, bookmarks, and applied filters are all saved as part of the session.
The log processing features of lnav can be used in scripts if you have a canned set of operations or queries that you want to perform regularly. You can enable headless mode with the ‘-n’ switch on the command-line and then use the ‘-c’ flag to specify the commands or queries you want to execute.
Support for Mac OS X and Linux.
- * Added support for themes and included a few as well: default, eldar, monocai, night-owl, solarized-light, and solarized-dark. The theme can be changed using the ‘:config’ command, like so: :config /ui/theme night-owl
Consult the online documentation for defining a new theme at: https://lnav.readthedocs.io/en/latest/config.html#theme-definitions
- * Added support for custom keymaps and included the following: de, fr, uk, us. The keymap can be changed using the ‘:config’ command, like so: :config /ui/keymap uk
Consult the online documentation for defining a new keymap at:
* Indexing of new data in log files can now be paused by pressing ‘=’ and unpaused by pressing it again. The bottom status bar will display ‘Paused’ in the right corner while paused.
- * CMake is now a supported way to build.
- * When viewing data from the standard-input, a symbolic name can be used to preserve session state. The name can be changed using the “rename-stdin” lnav script or by doing an UPDATE to the filepath column of the lnav_file table. For example, to assign the name “journald”, the following SQL statement can be executed in lnav:
;UPDATE lnav_file SET filepath=’journald’ WHERE filepath=’stdin’
- * The size of the terminal can be accessed in SQL using the $LINES and $COLS variables.
- * The raise_error(msg) SQL function has been added to make it easier to raise an error in an lnav script to stop execution and notify the user.
- * Added the json_concat() function to make it easier to append/concatenate values onto arrays.
- * Added the “:write-jsonlines-to” command that writes the result of a SQL query to a file in the JSON Lines format.
- * Data piped into lnav is no longer dumped to the console after exit. Instead a file containing the data is left in .lnav/stdin-captures/ and a message is printed to the console indicating the file name.
- * In time-offset mode, the deltas for messages before the first mark
are now negative instead of relative to the start of the log.
- * The $XDG_CONFIG_HOME environment variable (or ~/.config directory) are now respected for storing lnav’s configuration. If you have an existing ~/.lnav directory, that will continue to be used until you move it to $XDG_CONFIG_HOME/lnav or ~/.config/lnav.
- * Removed the ‘:save-config’ command. Changes to the configuration are now immediately saved.
- * Added ‘notice’ log level.
- * If a “timestamp-format” is used in an element of a “line-format”, the field name is ignored and a formatted timestamp is always used.
- * Ignore stdin when it is connected to /dev/null.
Copyright (c) 2010, Timothy Stack