lnav is a terminal-based log file viewer that merges, indexes, and analyzes multiple log files in a single interactive interface.
The tool solves the problem of viewing and analyzing logs across multiple files and formats by automatically detecting log formats, decompressing files as needed, merging entries by timestamp, and building an index of errors and warnings. It handles compressed files, follows file renames, and discovers new files in monitored directories. Rather than requiring separate invocations of standard Unix utilities like tail, grep, and less, lnav provides a unified terminal interface where logs appear in chronological order regardless of source.
lnav suits developers and operators who need to monitor or investigate logs from multiple sources simultaneously. It works well for systems generating structured logs in various formats, including JSON-lines, syslog, and web access logs. The tool distinguishes itself from basic utilities by understanding log message structure, enabling operations like jumping to the next error, filtering by SQLite expressions, viewing histograms of message frequency over time, and querying logs using SQL. Unlike tail, which cannot display multiple files in time order or scroll backward, grep, which returns only matching lines without context, or less, which handles only single files, lnav provides a comprehensive log analysis environment within the terminal.
The project maintains steady development activity with regular updates addressing bug fixes and feature enhancements. The maintainers actively engage with users through community channels and respond to issues and pull requests. The codebase receives ongoing refinement to improve performance and expand format support. Documentation is kept current with examples and tutorials, including an interactive online demo accessible via SSH for prospective users to evaluate the tool before installation.
