If you've ever found yourself buried under a mountain of log files, tailing multiple outputs, or grepping through endless lines trying to spot an error, it's time to meet your new best friend: lnav, the Logfile Navigator.
Lightweight, terminal-based, and surprisingly powerful, lnav is one of the most underrated tools for developers, sysadmins, and anyone who regularly digs into logs. It turns your chaotic logs into something that’s not only readable—but genuinely useful.
What is lnav and why use it ?
lnav (Logfile Navigator) is a command-line tool for viewing and analyzing log files. It goes beyond tail, less, or grep by:
- Automatically detecting and merging log formats.
- Highlighting timestamps, log levels, and errors.
- Providing SQL-like queries over your logs.
- Offering interactive navigation with a UI inside the terminal.
And yes, all of that without needing to set up a database or a server.
1. Installing lnav on Linux
Installation is straightforward. On most systems, you can install it via package managers:
On Ubuntu/Debian:
# apt install lnav
On Fedora:
# dnf install lnav
On Arch Linux:
# pacman -S lnav
Or build from source via GitHub if you want the latest version.
2. Use lnav Instead of Tail / Grep why?
Traditional tools are powerful, but they require manual work to chain together functionality. lnav gives you:
- Automatic multi-log parsing: Drop multiple logs in, and it merges them chronologically.
- Syntax highlighting: Errors and warnings stand out.
- SQL querying: Run queries like SELECT * FROM syslog_log WHERE log_level = 'error';
- Filtering and searching: Use intuitive filters and bookmarks to highlight specific entries.
3. Basic tool Usage is simple
Let’s say you want to inspect a system log:
# lnav /var/log/syslog
You'll immediately get:
- Color-coded output (timestamps, levels, messages).
- Scrollable view (arrow keys, PgUp, PgDn).
- Real-time updates (like tail -f).
- Search with /, filter with :filter-in, and even SQL queries.
Lets say you need to analyze Apache webserver logs recursively including the logs already rotated and gunzipped with *.gz extension on CentOS / Fedora / RHEL, you can do it with:
# lnav -r /var/log/httpd
You can parse the log file and get additional information about requests as well as you can print overall summary of log file.
Choose the line you want to parse. The selected line is always the one at the top of the window. Then press 'p' and you should see the following result:
Now, if you want to see a summary view of the logs by date and time, simply press 'i'.
To quit a screen you have chosen press 'q'.
4. LNAV helpful options and hotkeys
Once you've opened a log file/s for analyze you can use few hotkeys that will allow us to move through the output of lnav and the available views more easily:
e or E to jump to the next / previous error message.
w or W to jump to the next / previous warning message.
b or Backspace to move to the previous page.
Space to move to the next page.
g or G to move to the top / bottom of the current view.
To take a closer look at the way lnav operates, use -d option, the debug information is to be spit inside a .txt file:
# lnav /var/log/httpd -d lnav.txt
In this example, the debug information that is generated when lnav starts will be written to a file named lnav.txt inside the current working directory.
5. Real-World Use Cases
a. Troubleshooting application or system process Crashes
Open all relevant logs in one go:
# lnav /var/log/*.log
Errors are highlighted, and you can jump between them with n / N kbd keys.
b. Combining Multiple Logs
Working with an app that logs to different files and you need to combine:
# lnav /var/log/nginx/access.log /var/log/nginx/error.log
Or lets say you want to combine Apache Webserver with Haproxy log and get log summaries or filter out stuff:
# lnav /var/log/apache2/access.log /var/log/haproxy.log
Now you will get a single, chronological timeline of events.
If you want to Search for a concrete occurance of Error / Warning or IP address inside a bunch of loaded combined logs you can do it with the same command like in simple vim by pressing / (slash) from kbd and type out what you want to filter out to get shown.
c. Analyze SQL Queries Logs
Yes, you can actually do this by passing it query in its command prompt :
:.schema
:SELECT log_time, log_level, log_message FROM syslog_log WHERE log_level = 'error';
You get a table of filtered logs, sortable by columns.
6. lnav more usage command tips
- :help — Opens the help menu.
- :filter-in <string> — Show only lines matching <string>.
- :filter-out <string> — Hide lines matching <string>.
- :export-to <filename> — Export current view to a file.
- :tag <tagname> — Tag lines for later reference.
- q — Quit (but why would you want to?).
7. Using lnav as a pager for systemd-journald
# journalctl | lnav
# journalctl -f | lnav
# journalctl -u ssh.service | lnav
8. Use lnav to review remote ssh logs
Newer versions after 0.10 supports ssh protocol as well and theoretically should work:
# lnav user@server-name-here:/var/log/file.log
To read all logs inside /var/log
# lnav root@server-name-here:/var/log/
# lnav root@server-name-here:/var/log/*.err
9. Using lnav to view docker container logs
# docker logs 811ab84aa95l | lnav
# docker logs -f application | lnav
The latest version of lnav supports even the following simplified docker:// URL syntax:
# lnav docker://{container_id_or_name}/dir_path/to/log/file
# lnav docker://{container_id_or_name}/var/dir_path/log
# lnav docker://application/var/log/
# lnav docker://applcation/var/log/nginx/nginx.app.log
10. Monitoring compilation and command output useful for developers
Compilation from archived tar balls with ./configure && make etc. generate lot of outputs and logs while working.
Here is where the tool can come handy.
For example, here is how to watch the output of make command when compiling something:
# lnav -e './configure && make'
11. Learning lnav tool through online ssh service availability via lnav.org
f you're lazy to install it and want to test it anyways:
# Start The Basic Tutorial:
ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password tutorial1@demo.lnav.org
# Playground:
ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password playground@demo.lnav.org
Closure
While tools like Kibana, Grafana, and ELK stacks are powerful, they can be overkill for many use cases—especially when you're SSHed into a box and just need to get answers fast. That’s where lnav shines as it is fast, lightweight, visual and can be used offline.
If you’re a developer, sysadmin, SRE (Site Reliability Engineer), or just someone who cares about logs, give lnav a spin. It might just become among your favorite sysadm tools on Linux and safe you pretty much of time if you have to do log reading and analyzing on daily basis (for example if you're admining 20+ or more Linux servers.
