Log file navigator
Clone or download
Failed to load latest commit information.
docs [readline] pressing escape should exit the command prompt Nov 15, 2018
example-scripts [scripts] add an example script dir Apr 6, 2014
ext add pcapplusplus submodule Apr 15, 2017
m4 [build] add -static-libstdc++ and -static-libgcc by default Apr 11, 2017
release [release] version bump to v0.8.4 Aug 27, 2018
src xterm fix wasn't quite right... Nov 17, 2018
test try make locale test optional Nov 16, 2018
.gitignore add some compile-time artefacts to .gitignore Nov 19, 2016
.gitmodules use https for submodule Apr 15, 2017
.travis.yml try to fix after_script Nov 15, 2018
AUTHORS [hotkeys] change the filename hotkey to left/right arrow Mar 28, 2018
CMakeLists.txt [listview] get a batch of rows from the source instead of a single on… Mar 14, 2017
INSTALL first commit Sep 14, 2009
LICENSE add license Jan 17, 2010
Makefile.am [release] add a log generator for demo purposes Mar 22, 2014
NEWS [cmds] :write-json-to should passthru JSON columns as JSON instead of… Nov 15, 2018
README [highlights] allow the highlight color to be specified in log formats Dec 29, 2017
README.md Added -a hint to journald usage. Aug 25, 2018
TESTS_ENVIRONMENT.in [cmd] replace wordexp with shlex Dec 25, 2015
appveyor.yml Add cygwin continuous integration through appveyor May 31, 2016
autogen.sh [autogen] More fixes. Apr 6, 2015
configure.ac [perf] improve initial indexing times Oct 17, 2018
lnav.1 [format] try to validate formats against a given file Jul 11, 2015
lnav.cfg [cleanup] uncrustify Jun 16, 2013
snapcraft.yaml [release] version bump to v0.8.4 Aug 27, 2018


Build Status Build status Bounties LoC.

This is the source repository for lnav, visit http://lnav.org for a high level overview.

LNAV -- The Logfile Navigator

The log file navigator, lnav, is an enhanced log file viewer that takes advantage of any semantic information that can be gleaned from the files being viewed, such as timestamps and log levels. Using this extra semantic information, lnav can do things like interleaving messages from different files, generate histograms of messages over time, and providing hotkeys for navigating through the file. It is hoped that these features will allow the user to quickly and efficiently zero in on problems.


The following software packages are required to build lnav:

  • gcc/clang - A C++14-compatible compiler.
  • libpcre - The Perl Compatible Regular Expression (PCRE) library.
  • sqlite - The SQLite database engine. Version 3.9.0 or higher is required.
  • ncurses - The ncurses text UI library.
  • readline - The readline line editing library.
  • zlib - The zlib compression library.
  • bz2 - The bzip2 compression library.
  • libcurl - The cURL library for downloading files from URLs. Version 7.23.0 or higher is required.


Lnav follows the usual GNU style for configuring and installing software:

$ ./configure
$ make
$ sudo make install

Run ./autogen.sh before running any of the above commands when compiling from a cloned repository.

Cygwin users

It should compile fine in Cygwin.

Alternatively, you can get the generated binary from AppVeyor artifacts.

Remember that you still need the lnav dependencies under Cygwin, here is a quick way to do it:

setup-x86_64.exe -q -P libpcre1 -P libpcrecpp0 -P libsqlite3_0 -P libstdc++6

Currently, the x64 version seems to be working better than the x86 one.


The only file installed is the executable, lnav. You can execute it with no arguments to view the default set of files:

$ lnav

You can view all the syslog messages by running:

$ lnav /var/log/messages*

Usage with systemd-journald

On systems running systemd-journald, you can use lnav as the pager:

$ journalctl | lnav

or in follow mode:

$ journalctl -f | lnav

Since journalctl's default output format omits the year, if you are viewing logs which span multiple years you will need to change the output format to include the year, otherwise lnav gets confused:

$ journalctl -o short-iso | lnav

It is also possible to use journalctl's json output format and lnav will make use of additional fields such as PRIORITY and _SYSTEMD_UNIT:

$ journalctl -o json | lnav

In case some MESSAGE fields contain special characters such as ANSI color codes which are considered as unprintable by journalctl, specifying journalctl's -a option might be preferable in order to output those messages still in a non binary representation:

$ journalctl -a -o json | lnav

If using systemd v236 or newer, the output fields can be limited to the ones actually recognized by lnav for increased efficiency:

$ journalctl -o json --output-fields=MESSAGE,PRIORITY,_PID,SYSLOG_IDENTIFIER,_SYSTEMD_UNIT | lnav

If your system has been running for a long time, for increased efficiency you may want to limit the number of log lines fed into lnav, e.g. via journalctl's -n or --since=... options.

In case of a persistent journal, you may want to limit the number of log lines fed into lnav via journalctl's -b option.


The following screenshot shows a syslog file. Log lines are displayed with highlights. Errors are red and warnings are yellow.


See Also

The lnav website can be found at: