通过浏览器搜索linux日志,lnav: lnav 是一个日志文件浏览器，是一个基于 Curses 的工具，提供日志搜索、高亮显示等功能...

This is the source repository for lnav, visit http://lnav.org for a high level overview.

LNAV -- The Logfile Navigator

The Log File Navigator, lnav for short, is an advanced log file viewer

for the small-scale. It is a terminal application that can understand

your log files and make it easy for you to find problems with little to

no setup.

Screenshot

The following screenshot shows a syslog file. Log lines are displayed with

highlights. Errors are red and warnings are yellow.

Features

Log messages from different files are collated together into a single view

Automatic detection of log format

Automatic decompression of GZip and BZip2 files

Filter log messages based on regular expressions

Use SQL to analyze your logs

And more...

Installation

Usage

The only file installed is the executable, lnav. You can execute it

with no arguments to view the default set of files:

$ lnav

You can view all the syslog messages by running:

$ lnav /var/log/messages*

Usage with systemd-journald

On systems running systemd-journald, you can use lnav as the pager:

$ journalctl | lnav

or in follow mode:

$ journalctl -f | lnav

Since journalctl's default output format omits the year, if you are

viewing logs which span multiple years you will need to change the

output format to include the year, otherwise lnav gets confused:

$ journalctl -o short-iso | lnav

It is also possible to use journalctl's json output format and lnav

will make use of additional fields such as PRIORITY and _SYSTEMD_UNIT:

$ journalctl -o json | lnav

In case some MESSAGE fields contain special characters such as

ANSI color codes which are considered as unprintable by journalctl,

specifying journalctl's -a option might be preferable in order

to output those messages still in a non binary representation:

$ journalctl -a -o json | lnav

If using systemd v236 or newer, the output fields can be limited to

the ones actually recognized by lnav for increased efficiency:

$ journalctl -o json --output-fields=MESSAGE,PRIORITY,_PID,SYSLOG_IDENTIFIER,_SYSTEMD_UNIT | lnav

If your system has been running for a long time, for increased

efficiency you may want to limit the number of log lines fed into

lnav, e.g. via journalctl's -n or --since=... options.

In case of a persistent journal, you may want to limit the number

of log lines fed into lnav via journalctl's -b option.

Links

Contributing

Building From Source

Prerequisites

The following software packages are required to build lnav:

gcc/clang - A C++14-compatible compiler.

libpcre - The Perl Compatible Regular Expression (PCRE) library.

sqlite - The SQLite database engine. Version 3.9.0 or higher is required.

ncurses - The ncurses text UI library.

readline - The readline line editing library.

zlib - The zlib compression library.

bz2 - The bzip2 compression library.

libcurl - The cURL library for downloading files from URLs. Version 7.23.0 or higher is required.

libarchive - The libarchive library for opening archive files, like zip/tgz.

Build

Lnav follows the usual GNU style for configuring and installing software:

Run ./autogen.sh if compiling from a cloned repository.

$ ./configure

$ make

$ sudo make install

See Also

Angle-grinder is a tool to slice and dice log files on the command-line.

If you're familiar with the SumoLogic query language, you might find this tool more comfortable to work with.