The main arguments to lnav are the files, directories, glob patterns, or URLs to be viewed. If no arguments are given, the default syslog file for your system is opened.
Here’s an image of lnav in operation.
The main part of the display shows the log lines from the files interleaved based on time-of-day. New lines are automatically loaded as they are appended to the files and, if you are viewing the bottom of the files, lnav scrolls down to show the new lines.
Errors and warnings are colored in red and yellow, respectively. Highlights are also applied to: SQL keywords, IP addresses, XML tags, file and line numbers in Java backtraces, and quoted strings.
Log file contents are merged into a single view based on message timestamps. This saves a lot of time when correlating timestamps across multiple windows.
One of the features that we frequently use is filtering. It lets you display only lines matching a specific pattern, filtering out the noise. Press colon and then, for example, enter filter-in gnome-shell to show only lines matching “gnome-shell”. Filters also apply to log lines as they are loaded.
An even more powerful feature is querying logs with SQL statements. This lets you perform queries on messages without loading the data into an SQL database. Instead, lnav using SQlite3’s virtual table feature. For all supported log file types, lnav creates tables that can be queried using the subset of SQL supported by Sqlite3. Environment variables can be used in SQL statements by prefixing the variable name with a dollar-sign. The query mode is accessed by pressing semicolon. SQL queries are checked for correctness as you type.
There’s also the ability to amalgamate data by time with the timeline view. This shows a histogram of messages over time. It’s accessed by pressing the i key. You can zoom in and out in this view.
Complete list of articles in this series:
|tmux||A terminal multiplexer that offers a massive boost to your workflow|
|lnav||Advanced log file viewer for the small-scale; great for troubleshooting|
|Paperwork||Designed to simplify the management of your paperwork|
|Abricotine||Markdown editor with inline preview functionality|
|mdless||Formatted and highlighted view of Markdown files|
|fkill||Kill processes quick and easy|
|Tusk||An unofficial Evernote client with bags of potential|
|Ulauncher||Sublime application launcher|
|McFly||Navigate through your bash shell history|
|LanguageTool||Style and grammar checker for 30+ languages|
|peco||Simple interactive filtering tool that's remarkably useful|
|Liquid Prompt||Adaptive prompt for Bash & Zsh|
|Ananicy||Shell daemon created to manage processes’ IO and CPU priorities|
|cheat.sh||Community driven unified cheat sheet|
|ripgrep||Recursively search directories for a regex pattern|
|exa||A turbo-charged alternative to the venerable ls command|
|OCRmyPDF||Add OCR text layer to scanned PDFs|
|Watson||Track the time spent on projects|
|fontpreview||Quickly search and preview fonts|
|fd||Wonderful alternative to the venerable find|
|scrcpy||Display and control Android devices|