7 ms·

Lnav Logfile Navigator

156 points by alexzeitler 2y ago

mgoetzke 2y ago
I just found this tool a few days ago using GPT-4o looking for a better way to navigate and search logs. I did try it now and it looks great. The histogram view could be improved to use a highlighted center line instead of the top line, but its quite helpful (once you read about SHIFT-I)
kalev 2y ago
LNAV is great, i’m so happy to have found it recently. I’ve made a Caddy server lnav configuration file a while a go, for who’s struggling to parse the default JSON logs produced by Caddy. https://gist.github.com/vjanssens/3c6fb8393d87346323d939f1728ca293 https://gist.github.com/vjanssens/3c6fb8393d87346323d939f172...
terminaltrove 2y ago
[dead]
evanjrowley 2y ago
Is there something like this that's lightweight and works well on (non-WSL) Windows? I have Windows Servers with tools that create text-based logs and it would be nice to have something that could tail them.
- achoice 2y ago
  Baretail is what I have used allot. Really old but works good. Like the simple config to color lines. https://www.baremetalsoft.com/baretail/ https://www.baremetalsoft.com/baretail/
- tstack 2y ago
  LogViewPlus (https://www.logviewplus.com https://www.logviewplus.com) is very similar to lnav and built for Windows.
- rileytg 2y ago
  notepad++ is great for log files. it handles massive files with ease. I wish it ran on non win systems…
- nix0n 2y ago
  If you just want old-school `tail` and `less` you can get them with Cygwin. These don't support multi-file or highlighting like `lnav` does, but even on top of Cygwin they're very lightweight.
justusthane 2y ago
lnav is something I keep coming back to over and over really _wanting_ to like, but I've never managed to figure it out. I'm not sure exactly what the problem is, but I find the docs confusing and incomplete, and I always end up getting stuck and going back to Vim and/or VisiData. Does anyone have any good tutorials or resources apart from the official ones?
- tstack 2y ago
  I'm the author of lnav .. and not a very good writer, apologies. I guess my main question would be, what are you expecting to get out of lnav? I use it primarily for merging log files together and just jumping around trying to understand what was happening. It has a bunch of other functionality, like using SQL for analysis, but that's not something I use regularly. Really, a lot of the benefits of lnav are automatic, like uncompressing files, detecting log formats, tailing... So, if that's not something that comes up for you, it might just not be the tool for you. I actually have this "not getting it" problem with VisiData/multitail. I start them up and they don't behave like I would expect when pressing hotkeys.
  - justusthane 2y ago
    > I start them up and they don't behave like I would expect when pressing hotkeys That's funny, because that's been my experience with lnav! Not saying there's anything wrong with it though. It's been a while since last time I tried it so I don't recall the exact stumbling blocks I ran into, but I think it was mostly around hotkeys not doing what I expected, lnav not recognizing log types I think it should have (Apache/Tomcat), and not correctly loading custom log parsers. If you don't mind next time I try it I can give you more concrete info.
    - tstack 2y ago
      > That's funny, because that's been my experience with lnav! Not saying there's anything wrong with it though. I tried to use the hotkeys from less/more/vim so that it would be somewhat familiar. I think people are frequently tripped up if files are not recognized as a log and just treated as text. Files treated as plain text are separated from log files, so it can be a bit confusing. Not entirely sure how to improve the experience there. > lnav not recognizing log types I think it should have (Apache/Tomcat) There are quite a few log formats builtin. But, since log output formats can be customized by admins, it's possible they deviate from the builtin ones and things won't "just work". > not correctly loading custom log parsers I've tried to improve error messages a bunch[1] and make it easier to trouble shoot configuration issues[2]. I'm sure more could be done, I just don't quite know what folks are tripping over without feedback. > If you don't mind next time I try it I can give you more concrete info. Feel free to file github issues or email support@lnav.org [1] - https://lnav.org/2022/08/04/pretty-errors.html https://lnav.org/2022/08/04/pretty-errors.html [2] - https://lnav.org/2023/08/04/config-dump.html https://lnav.org/2023/08/04/config-dump.html
__bax 2y ago
Best log tool !
jldugger 2y ago
It's still just looking at one server right? If you have a fleet of webservers, or microservices in containers, ELK or similar seems like a requirement.
- tstack 2y ago
  Pretty much, yes, it's not for dealing with a bunch of servers. There's some basic support for tailing files on remote x86 machines (https://lnav.org/2021/05/03/tailing-remote-files.html https://lnav.org/2021/05/03/tailing-remote-files.html). But, again, just small scale stuff. I use it on my development machine and for going through logs attached to bugs. Those use cases aren't served by something like ELK/splunk/etc.
piterrro 2y ago
For anyone looking for a similar tool but with a Web UI I recommend taking a look at Logdy (https://logdy.dev/ https://logdy.dev/, https://github.com/logdyhq/logdy-core https://github.com/logdyhq/logdy-core) Ps: I'm the author
- iudqnolq 2y ago
  That's interesting. Would it be possible to embed it in a go program to have an easy way of visualizing logs out of the box?
  - piterrro 2y ago
    not yet, but its one of the items on my roadmap
- zX41ZdbW 2y ago
  Thank you, that's interesting. A small feedback about the website - it uses the "Space Mono" font for the installation snippet - it is a monospace font, but surprisingly, it collapses "fi" into a ligature, making the font subtly and weirdly non-monospace. This is wrong.
dr_kiszonka 2y ago
Would anyone have a recommendation for a log mining / analysis tool? I am particularly interested in automated identification of message sequences across multiple users, but anything beyond a simple log browser would be helpful. (I work with hundreds of GBs of Logcat logs.)
chrisweekly 2y ago
I've been singing lnav's praises ever since I first discovered it back in... 2016?
flusensieb 2y ago
Not a CLI tool, but I recently started using https://klogg.filimonov.dev/ https://klogg.filimonov.dev/ klogg (which seems to be a successor of glogg) more and more often.
synergy20 2y ago
I ended up using vim for log files, it recognizes messages and log files and highlight them automatically and I can also edit them if needed.
- tstack 2y ago
  > I can also edit them if needed. That doesn't seem .. wise. lnav has support for filtering, bookmarking, and attaching tags/comments[1] to log messages so that editing the log file isn't required. The filters, bookmarks, tags, and comments are saved separately so they can be restored when the file(s) are reopened. [1] - https://docs.lnav.org/en/v0.12.2/usage.html#taking-notes https://docs.lnav.org/en/v0.12.2/usage.html#taking-notes
hyperman1 2y ago
I tried it recently but got overwhelmed by its interface. I didn't understand all the colors and what I could do at each point. I'll retry later as it seems worth it as replacement of grep/sed/.... , but I'll have to reserve enought time to slowly go through it.

156 points by alexzeitler 2y ago

I just found this tool a few days ago using GPT-4o looking for a better way to navigate and search logs. I did try it now and it looks great. The histogram view could be improved to use a highlighted center line instead of the top line, but its quite helpful (once you read about SHIFT-I)

kalev 2y ago

LNAV is great, i’m so happy to have found it recently. I’ve made a Caddy server lnav configuration file a while a go, for who’s struggling to parse the default JSON logs produced by Caddy. https://gist.github.com/vjanssens/3c6fb8393d87346323d939f1728ca293 https://gist.github.com/vjanssens/3c6fb8393d87346323d939f172...

terminaltrove 2y ago

[dead]

evanjrowley 2y ago

Is there something like this that's lightweight and works well on (non-WSL) Windows? I have Windows Servers with tools that create text-based logs and it would be nice to have something that could tail them.

achoice 2y ago
Baretail is what I have used allot. Really old but works good. Like the simple config to color lines. https://www.baremetalsoft.com/baretail/ https://www.baremetalsoft.com/baretail/
tstack 2y ago
LogViewPlus (https://www.logviewplus.com https://www.logviewplus.com) is very similar to lnav and built for Windows.
rileytg 2y ago
notepad++ is great for log files. it handles massive files with ease. I wish it ran on non win systems…
nix0n 2y ago
If you just want old-school `tail` and `less` you can get them with Cygwin. These don't support multi-file or highlighting like `lnav` does, but even on top of Cygwin they're very lightweight.

justusthane 2y ago

lnav is something I keep coming back to over and over really _wanting_ to like, but I've never managed to figure it out. I'm not sure exactly what the problem is, but I find the docs confusing and incomplete, and I always end up getting stuck and going back to Vim and/or VisiData. Does anyone have any good tutorials or resources apart from the official ones?

tstack 2y ago
I'm the author of lnav .. and not a very good writer, apologies. I guess my main question would be, what are you expecting to get out of lnav? I use it primarily for merging log files together and just jumping around trying to understand what was happening. It has a bunch of other functionality, like using SQL for analysis, but that's not something I use regularly. Really, a lot of the benefits of lnav are automatic, like uncompressing files, detecting log formats, tailing... So, if that's not something that comes up for you, it might just not be the tool for you. I actually have this "not getting it" problem with VisiData/multitail. I start them up and they don't behave like I would expect when pressing hotkeys.
- justusthane 2y ago
  > I start them up and they don't behave like I would expect when pressing hotkeys That's funny, because that's been my experience with lnav! Not saying there's anything wrong with it though. It's been a while since last time I tried it so I don't recall the exact stumbling blocks I ran into, but I think it was mostly around hotkeys not doing what I expected, lnav not recognizing log types I think it should have (Apache/Tomcat), and not correctly loading custom log parsers. If you don't mind next time I try it I can give you more concrete info.
  - tstack 2y ago
    > That's funny, because that's been my experience with lnav! Not saying there's anything wrong with it though. I tried to use the hotkeys from less/more/vim so that it would be somewhat familiar. I think people are frequently tripped up if files are not recognized as a log and just treated as text. Files treated as plain text are separated from log files, so it can be a bit confusing. Not entirely sure how to improve the experience there. > lnav not recognizing log types I think it should have (Apache/Tomcat) There are quite a few log formats builtin. But, since log output formats can be customized by admins, it's possible they deviate from the builtin ones and things won't "just work". > not correctly loading custom log parsers I've tried to improve error messages a bunch[1] and make it easier to trouble shoot configuration issues[2]. I'm sure more could be done, I just don't quite know what folks are tripping over without feedback. > If you don't mind next time I try it I can give you more concrete info. Feel free to file github issues or email support@lnav.org [1] - https://lnav.org/2022/08/04/pretty-errors.html https://lnav.org/2022/08/04/pretty-errors.html [2] - https://lnav.org/2023/08/04/config-dump.html https://lnav.org/2023/08/04/config-dump.html

__bax 2y ago

Best log tool !

jldugger 2y ago

It's still just looking at one server right? If you have a fleet of webservers, or microservices in containers, ELK or similar seems like a requirement.

tstack 2y ago
Pretty much, yes, it's not for dealing with a bunch of servers. There's some basic support for tailing files on remote x86 machines (https://lnav.org/2021/05/03/tailing-remote-files.html https://lnav.org/2021/05/03/tailing-remote-files.html). But, again, just small scale stuff. I use it on my development machine and for going through logs attached to bugs. Those use cases aren't served by something like ELK/splunk/etc.

piterrro 2y ago

For anyone looking for a similar tool but with a Web UI I recommend taking a look at Logdy (https://logdy.dev/ https://logdy.dev/, https://github.com/logdyhq/logdy-core https://github.com/logdyhq/logdy-core) Ps: I'm the author

iudqnolq 2y ago
That's interesting. Would it be possible to embed it in a go program to have an easy way of visualizing logs out of the box?
- piterrro 2y ago
  not yet, but its one of the items on my roadmap
zX41ZdbW 2y ago
Thank you, that's interesting. A small feedback about the website - it uses the "Space Mono" font for the installation snippet - it is a monospace font, but surprisingly, it collapses "fi" into a ligature, making the font subtly and weirdly non-monospace. This is wrong.

dr_kiszonka 2y ago

Would anyone have a recommendation for a log mining / analysis tool? I am particularly interested in automated identification of message sequences across multiple users, but anything beyond a simple log browser would be helpful. (I work with hundreds of GBs of Logcat logs.)

chrisweekly 2y ago

I've been singing lnav's praises ever since I first discovered it back in... 2016?

flusensieb 2y ago

Not a CLI tool, but I recently started using https://klogg.filimonov.dev/ https://klogg.filimonov.dev/ klogg (which seems to be a successor of glogg) more and more often.

synergy20 2y ago

I ended up using vim for log files, it recognizes messages and log files and highlight them automatically and I can also edit them if needed.

tstack 2y ago
> I can also edit them if needed. That doesn't seem .. wise. lnav has support for filtering, bookmarking, and attaching tags/comments[1] to log messages so that editing the log file isn't required. The filters, bookmarks, tags, and comments are saved separately so they can be restored when the file(s) are reopened. [1] - https://docs.lnav.org/en/v0.12.2/usage.html#taking-notes https://docs.lnav.org/en/v0.12.2/usage.html#taking-notes

hyperman1 2y ago

I tried it recently but got overwhelmed by its interface. I didn't understand all the colors and what I could do at each point. I'll retry later as it seems worth it as replacement of grep/sed/.... , but I'll have to reserve enought time to slowly go through it.