Log files loaded into lnav are parsed based on formats defined in configuration files. Many formats are already built in to the lnav binary and you can define your own using a JSON file. When loading files, each format is checked to see if it can parse the first few lines in the file. Once a match is found, that format will be considered that files format and used to parse the remaining lines in the file. If no match is found, the file is considered to be plain text and can be viewed in the “text” view that is accessed with the t key.
The following log formats are built into lnav:
| Name | Table Name | Description |
|---|---|---|
| Common Access Log | access_log | The default web access log format for servers like Apache. |
| Amazon ALB log | alb_log | Log format for Amazon Application Load Balancers |
| Generic Block | block_log | A generic format for logs, like cron, that have a date at the start of a block. |
| Bunyan log | bunyan_log | Bunyan JSON logging library for node.js |
| Caddy log format | caddy_log | |
| Candlepin log format | candlepin_log | Log format used by Candlepin registration system |
| Yum choose_repo Log | choose_repo_log | The log format for the yum choose_repo tool. |
| Cloudflare Access Log | cloudflare_json_log | Cloudflare Enterprise detailed logs of metadata |
| CloudVM Ram Log | cloudvm_ram_log | Periodic dumps of ram sizes |
| CUPS log format | cups_log | Log format used by the Common Unix Printing System |
| Dpkg Log | dpkg_log | The debian dpkg log. |
| ecs | ecs_log | Elastic Common Schema (ECS) defines a common set of fields for ingesting data into Elasticsearch including log records |
| Amazon ELB log | elb_log | Log format for Amazon Elastic Load Balancers |
| engine log | engine_log | The log format for the engine.log files from RHEV/oVirt |
| env_logger format | env_logger_log | Format file for Rust’s env_logger crate |
| Common Error Log | error_log | The default web error log format for servers like Apache. |
| ESXi Syslog | esx_syslog_log | Format specific to the ESXi syslog |
| Fsck_hfs Log | fsck_hfs_log | Log for the fsck_hfs tool on Mac OS X. |
| GitHub Events Log | github_events_log | Format for the public GitHub timeline from gharchive.org |
| Glog | glog_log | The google glog format. |
| HAProxy HTTP Log Format | haproxy_log | The HAProxy log format |
| Java log format | java_log | Log format used by log4j and output by most java programs |
| journalctl JSON log format | journald_json_log | Logger format as created by systemd journalctl -o json |
| Katello log format | katello_log | Log format used by katello and foreman as used in Satellite 6. |
| lnav debug log | lnav_debug_log | Log format for lnav’s own debug log |
| Nextcloud server logs | nextcloud | Nextcloud JSON server logs audit.log, flow.log, and nextcloud.log |
| Nextflow log format | nextflow_log | Format file for nextflow.io logs |
| OpenAM Log | openam_log | The OpenAM identity provider. |
| OpenAM Debug Log | openamdb_log | Debug logs for the OpenAM identity provider. |
| OpenStack log format | openstack_log | The log format for the OpenStack log files |
| CUPS Page Log | page_log | The CUPS server log of printed pages. |
| Packet Capture | pcap_log | Internal format for pcap files |
| Process State | procstate_log | Periodic dumps of process state |
| Proxifier | proxifier_log | Proxifier proxy client |
| Ruby on Rails | rails_log | Format for ruby on rails |
| Redis | redis_log | The Redis database |
| S3 Access Log | s3_log | S3 server access log format |
| simple_logger format | simple_rs_log | Format file for Rust’s simple_logger crate |
| SnapLogic Server Log | snaplogic_log | The SnapLogic server log format. |
| SSSD log format | sssd_log | Log format used by the System Security Services Daemon |
| Strace | strace_log | The strace output format. |
| sudo | sudo_log | The sudo privilege management tool. |
| Syslog | syslog_log | The system logger format found on most posix systems. |
| TCF Log | tcf_log | Target Communication Framework log |
| TCSH History | tcsh_history | The tcsh history file format. |
| UniFi iptables log | unifi_iptables_log | The UniFi gateway iptables logger format (for /var/log/iptables). |
| UniFi log | unifi_log | The UniFi gateway messages logger format (for /var/log/messages). |
| Uwsgi Log | uwsgi_log | The uwsgi log format. |
| Vdsm Logs | vdsm_log | Vdsm log format |
| VMKernel Logs | vmk_log | The VMKernel’s log format |
| VMware Logs | vmw_log | One of the log formats used in VMware’s ESXi and vCenter software. |
| VMware vSphere log format | vmw_py_log | The log format for some VMware vSphere services |
| VMware Go Log | vmw_vc_svc_log | Log files for go-based logs |
| VMWare PostgreSQL | vpostgres_log | Format for vpostgresql log files with format ‘%m %c %x %d %u %r %p %l’ |
| web robot log | web_robot_log | |
| RHN server XMLRPC log format | xmlrpc_log | Generated by Satellite’s XMLRPC component |
| ZooKeeper log format | zookeeper_log | Log format for the ZooKeeper coordination service |
In addition to the above formats, the following self-describing formats are supported:
The Bro Network Security Monitor TSV log format is supported in lnav versions v0.8.3+. The Bro log format is self-describing, so lnav will read the header to determine the shape of the file.
The W3C Extended Log File Format is supported in lnav versions v0.10.0+. The W3C log format is self-describing, so lnav will read the header to determine the shape of the file.
Logs encoded as JSON-lines can be parsed and pretty-printed in lnav by creating a log format file. The format file is a bit simpler to create since it doesn’t require a regular expression to match plain text. Instead, the format defines the relevant fields and provides a line-format array that specifies how the fields in the JSON object should be displayed.
See the following formats that are built into lnav as examples:
There is also basic support for the logfmt convention for formatting log messages. Files that use this format must have the entire line be key/value pairs and the timestamp contained in a field named time or ts. If the file you’re using does not quite follow this formatting, but wraps logfmt data with another recognized format, you can use the logfmt2json(str) SQL function to convert the data into JSON for further analysis.
New log formats can be defined by placing JSON configuration files in subdirectories of the /etc/lnav/formats and ~/.lnav/formats/ directories. The directories and files can be named anything you like, but the files must have the ‘.json’ suffix. A sample file containing the builtin configuration will be written to this directory when lnav starts up. You can consult that file when writing your own formats or if you need to modify existing ones. Format directories can also contain ‘.sql’ and ‘.lnav’ script files that can be used automate log file analysis.