IT Solutions Technology Blog

Linux command ’lnav‘ – is an advanced log file viewer for the terminal it provides an easy-to-use interface for monitoring and analyzing your log files with little to no setup. Simply point lnav at your log files and it will automatically detect the Log Formats index their contents and display a combined view of all log messages andou can navigate through your logs using a variety of hotkeys

root@rpi-NodeRed-01:~#
root@rpi-NodeRed-01:~# apt-get install lnav
Reading package lists… Done
Building dependency tree… Done
Reading state information… Done
lnav is already the newest version (0.9.0-1).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root@rpi-NodeRed-01:~#

root@rpi-NodeRed-01:~# lnav -V
lnav 0.9.0

root@rpi-NodeRed-01:~#

Some usefull hotkeys

e / E : jump to next/previous ERROR
w / W: jump to next/previous WARNING
d / D : forward / backward 24 hours
0 / shift 0 : next / previous day
ctrl-r : reset all filters and highlights
i : show a histogram with number of errors per day :exclamation:
p / shift p : show / stop showing JSON messages in a pretty way :exclamation:
/ : search a string of regular expression
g / G : go to top or bottom of the file

root@rpi-NodeRed-01:~# lnav

Log analysis in lnav can be done using the SQLite interface

Log messages can be accessed via virtual tables that are created for each file format and the tables have the same name as the log format and each message is its own row in the table a simple query to perform on an Apache access log might be to get the average and maximum number of bytes returned by the server grouped by IP@

;SELECT c_ip, avg(sc_bytes), max(sc_bytes) FROM access_log GROUP BY c_ip