# lnav

> Terminal log file viewer that merges, formats, and indexes log files with SQL analysis and real-time monitoring

Stars: 10.8k · Language: C++ · License: BSD-2-Clause · Categories: System

- Repository: https://github.com/tstack/lnav
- Website: http://lnav.org
- Page: https://www.trmn.sh/tools/lnav

## Install

- Homebrew: `brew install lnav`
- FreeBSD: `pkg install lnav`

## Overview

lnav is a terminal-based log file viewer that automatically detects log formats, decompresses files, and merges multiple log sources into a single chronological view. It can monitor directories for new files, follow file renames, and build indexes of errors and warnings for quick navigation. The tool handles various log formats including JSON lines and can pretty-print structured data.

The TUI interface provides spatial navigation with hotkeys to jump between errors (`e`/`E`), search with regular expressions (`/`), and filter messages using regex or SQLite expressions. Users can view message histograms over time (`i`), analyze logs with embedded SQLite queries (`;`), and highlight patterns with the `:highlight` command. The tool supports real-time tailing and can process compressed log files without manual decompression.

lnav integrates well with systemd-journald through piped input from `journalctl`, supporting both standard and JSON output formats. It recognizes additional fields like PRIORITY and _SYSTEMD_UNIT when using JSON format. The tool is particularly useful for system administrators, DevOps engineers, and developers who need to correlate events across multiple log sources and perform complex log analysis beyond basic grep and tail functionality.

### Installation

```bash
# via Homebrew
brew install lnav
```

```bash
# via FreeBSD
pkg install lnav
```

![lnav interface showing mixed syslog and web access logs](https://media.trmn.sh/cached/8166c1fc34355c85376386eb04f78904b92e195ff269cef056e78dd1b243cc5f.png)

## Alternatives

- [csysdig](https://www.trmn.sh/tools/sysdig.md): Linux system visibility tool that captures syscalls and OS events, with container support; csysdig is its curses-based UI. (C++, 8.3k stars)
- [ncmpcpp](https://www.trmn.sh/tools/ncmpcpp.md): ncurses-based terminal client for MPD (Music Player Daemon) with tag editor, playlist editor, media library, and visualizer, inspired by ncmpc. (C++, 2.5k stars)
- [btop](https://www.trmn.sh/tools/btop.md): Terminal-based system resource monitor showing CPU, memory, disk, network, and process information (C++, 35.2k stars)
- [bpytop](https://www.trmn.sh/tools/bpytop.md): Terminal-based system resource monitor showing CPU, memory, disk, network and process usage with interactive interface (Python, 10.9k stars)
- [nvtop](https://www.trmn.sh/tools/nvtop.md): htop-like GPU and accelerator task monitor supporting NVIDIA, AMD, Intel, Apple, and other vendors (C, 11.1k stars)

## Guides

- [Modern Replacements for tail](https://www.trmn.sh/replace/tail): lnav and stern compared as tail replacements: local log files, journald and compressed logs with lnav, Kubernetes pod logs with stern.
- [Best Log Viewers for the Terminal](https://www.trmn.sh/best/log-viewers): Compare lnav, logss and stern for reading, tailing, searching and filtering logs in a terminal, from local files to Kubernetes pods.

---

Canonical: https://www.trmn.sh/tools/lnav