lnav — The Logfile Navigator with SQL and Live Tailing

What it is

lnav is an advanced log file viewer for the terminal that understands dozens of log formats out of the box. It merges multiple log files by timestamp, provides SQL queries against log records, live-tails rotating files, and highlights errors and warnings automatically. Unlike tail -f or grep, lnav gives you a structured, queryable view of your logs.

The tool targets system administrators, SREs, and developers who debug production issues by reading log files. It works with syslog, Apache, NGINX, Docker, journald, and many other formats without configuration.

How it saves time or tokens

lnav replaces the cycle of grep, awk, and tail commands with a single interactive viewer. SQL queries let you aggregate, filter, and correlate log events without piping between tools. Timestamp-based merging across multiple files means you see events in chronological order regardless of which service produced them. For incident response, this reduces log investigation time from minutes of command chaining to seconds of SQL queries.

How to use

1. Install lnav:

brew install lnav

1. Open one or more log files:

lnav /var/log/nginx/access.log /var/log/app/*.log

1. Inside lnav, use keyboard shortcuts and SQL:

-- Jump to a specific time
:go 15:30

-- Query log records
;SELECT c_ip, COUNT(*) FROM nginx_log GROUP BY c_ip ORDER BY COUNT(*) DESC LIMIT 10

Example

Investigate a spike in 500 errors across multiple services:

# Open all relevant logs
lnav /var/log/nginx/error.log /var/log/app/api.log /var/log/app/worker.log

# Inside lnav - find error patterns
;SELECT log_time, log_level, log_body 
 FROM all_logs 
 WHERE log_level = 'error' 
 AND log_time > '2026-04-15 14:00'
 ORDER BY log_time

# Filter to specific IP
:filter-in 192.168.1.100

lnav merges all three log files by timestamp, so you see the exact sequence of events across services.

Related on TokRepo

• AI Tools for Monitoring — Monitoring and observability tools for production systems
• AI Tools for DevOps — DevOps tools for debugging and incident response

Common pitfalls

• lnav auto-detects log formats, but custom formats need a JSON format definition file. Without it, custom logs display as plain text without structure.
• SQL queries run against in-memory log data. Very large log files (10GB+) may cause high memory usage. Filter or limit the time range before loading.
• The :go time command uses the log file's timezone. Ensure your log timestamps include timezone information to avoid confusion with UTC offsets.