You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Tim Stack e1f52dd6e2 bump version in conanfile 19 hours ago
.github [build] install pcre2 libs 3 weeks ago
cmake [pcre2] migrate from pcre to pcre2 3 weeks ago
demo [demo] bump version 2 weeks ago
docs [docs] add refs to the vscode extension 4 days ago
example-scripts [example files]: fix shellcheck identified issues 1 year ago
ext add pcapplusplus submodule 6 years ago
m4 [sql] add parse_url()/unparse_url() functions 2 weeks ago
release [release] try beta1 release 6 days ago
src [view_curses] remove fallback arg in to_attrs() 1 day ago
test [ansi] fix perf bug in eraser 3 days ago
tools [status] some more user notification tweaks 3 months ago
.cirrus.yml [cirrus/ci] Use a recent FreeBSD image 2 years ago
.clang-format [clang-format] init 7 months ago
.clang-tidy [tidy] some more tidying 6 months ago
.codespellrc [build] run cmake-init and switch from hunter to conan for packages 7 months ago
.coveralls.yml [ci] add .coveralls.yml 2 years ago
.gitignore [am] remove 1 week ago
.gitmodules use https for submodule 6 years ago
.readthedocs.yaml [data_scanner] fix quoted string regex 2 years ago [docs] update links from to 6 months ago
AUTHORS [release] bump release number 7 months ago
CMakeLists.txt [release] bump version and try to automate some stuff 2 weeks ago
CMakePresets.json [build] run cmake-init and switch from hunter to conan for packages 7 months ago
CMakeUserPresets.json.example [cmake] add user preset example 7 months ago
FUNDING.yml Create FUNDING.yml 2 years ago
INSTALL first commit 13 years ago
LICENSE add license 13 years ago [status] some more user notification tweaks 3 months ago [NEWS] update news for non-JSON-lines change 4 days ago
README [readme] mention running in the regular README 1 week ago [log_format] perform more validations on log formats 2 weeks ago [tests] test_tailer tweaks 7 days ago
appveyor.yml [appveyor] turn off parallel compilation 6 days ago [autogen] More fixes. 8 years ago [regex101] add an integration with regex101 5 months ago bump version in conanfile 19 hours ago [build] fix static lib name for pcre2 6 days ago
lnav.1 [docs] some more updates to docs 2 months ago
lnav.cfg [cleanup] uncrustify 9 years ago
snapcraft.yaml [snap] fix pcre2 lib name 2 weeks ago [regex101] add an integration with regex101 5 months ago

Build Docs Coverage Status lnav

This is the source repository for lnav, visit for a high level overview.

LNAV -- The Logfile Navigator

The Log File Navigator, lnav for short, is an advanced log file viewer for the small-scale. It is a terminal application that can understand your log files and make it easy for you to find problems with little to no setup.


The following screenshot shows a syslog file. Log lines are displayed with highlights. Errors are red and warnings are yellow.



  • Log messages from different files are collated together into a single view
  • Automatic detection of log format
  • Automatic decompression of GZip and BZip2 files
  • Filter log messages based on regular expressions
  • Use SQL to analyze your logs
  • And more...


Download a statically-linked binary for Linux/MacOS from the release page


The only file installed is the executable, lnav. You can execute it with no arguments to view the default set of files:

$ lnav

You can view all the syslog messages by running:

$ lnav /var/log/messages*

Usage with systemd-journald

On systems running systemd-journald, you can use lnav as the pager:

$ journalctl | lnav

or in follow mode:

$ journalctl -f | lnav

Since journalctl's default output format omits the year, if you are viewing logs which span multiple years you will need to change the output format to include the year, otherwise lnav gets confused:

$ journalctl -o short-iso | lnav

It is also possible to use journalctl's json output format and lnav will make use of additional fields such as PRIORITY and _SYSTEMD_UNIT:

$ journalctl -o json | lnav

In case some MESSAGE fields contain special characters such as ANSI color codes which are considered as unprintable by journalctl, specifying journalctl's -a option might be preferable in order to output those messages still in a non-binary representation:

$ journalctl -a -o json | lnav

If using systemd v236 or newer, the output fields can be limited to the ones actually recognized by lnav for increased efficiency:

$ journalctl -o json --output-fields=MESSAGE,PRIORITY,_PID,SYSLOG_IDENTIFIER,_SYSTEMD_UNIT | lnav

If your system has been running for a long time, for increased efficiency you may want to limit the number of log lines fed into lnav, e.g. via journalctl's -n or --since=... options.

In case of a persistent journal, you may want to limit the number of log lines fed into lnav via journalctl's -b option.


Please file issues on this repository or use the discussions section. The following alternatives are also available:


Building From Source


The following software packages are required to build lnav:

  • gcc/clang - A C++14-compatible compiler.
  • libpcre2 - The Perl Compatible Regular Expression v2 (PCRE2) library.
  • sqlite - The SQLite database engine. Version 3.9.0 or higher is required.
  • ncurses - The ncurses text UI library.
  • readline - The readline line editing library.
  • zlib - The zlib compression library.
  • bz2 - The bzip2 compression library.
  • libcurl - The cURL library for downloading files from URLs. Version 7.23.0 or higher is required.
  • libarchive - The libarchive library for opening archive files, like zip/tgz.
  • wireshark - The 'tshark' program is used to interpret pcap files.


Lnav follows the usual GNU style for configuring and installing software:

Run ./ if compiling from a cloned repository.

$ ./configure
$ make
$ sudo make install

See Also

Angle-grinder is a tool to slice and dice log files on the command-line. If you're familiar with the SumoLogic query language, you might find this tool more comfortable to work with.