lnav Changelog

What's new in lnav 0.8.1

Oct 25, 2016
  • FEATURES:
  • Added a spectrogram command and view that displays the values of a numeric field over time. The view works for log message fields or for database result columns.
  • Log formats can now create SQL views and execute other statements by adding '.sql' files to their format directories. The SQL scripts will be executed on startup.
  • Added 'json_group_object' and 'json_group_array' aggregate SQL functions that collects values from a GROUP BY query into a JSON object or array, respectively.
  • The SQL view will now graph values found in JSON objects/arrays in addition to the regular columns in the result.
  • Added an 'regexp_match(, )' SQL function that can be used to extract values from a string using a regular expression.
  • Added an 'extract()' SQL function that extracts values using the same data discover/extraction parser used in the 'logline' table.
  • Added a "summary" overlay line to the bottom of the log view that displays how long ago the last message was received, along with the total number of files and the error rate over the past five minutes.
  • Pressing 'V' in the DB view will now check for a column with a timestamp and move to the corresponding time in the log view.
  • Added 'a/A' hotkeys to restore a view previously popped with 'q/Q'.
  • Added ":hide-lines-before", ":hide-lines-after", and ":show-lines-before-and-after" commands so that you can filter out log lines based on time.
  • Scripts containing lnav commands/queries can now be executed using the pipe ('|') hotkey. See the documentation for more information.
  • Added an ":eval" command that can be used to execute a command or query after performing environment variable substitution.
  • Added an ":echo" command that can be useful for scripts to message the user.
  • The "log_part" column can now be set with an SQL UPDATE statement.
  • Added a "log_body" hidden column that returns the body of the log message.
  • Added ":config", ":reset-config", and ":save-config" commands to change configuration options, reset to default, and save them for future executions.
  • Added a "/ui/clock-format" configuration option that controls the time format in the top-left corner.
  • Added a "/ui/dim-text" configuration option that controls the brightness of text in the UI.
  • Added support for TAI64 timestamps (http://cr.yp.to/libtai/tai64.html).
  • Added a safe execution mode. If the 'LNAVSECURE' environment variable is set before executing lnav, the following commands are disabled:
  • open
  • pipe-to
  • pipe-line-to
  • write-*-to This makes it easier to run lnav with escalated privileges in restricted environments, without the risk of users being able to use the above mentioned commands to gain privileged access.
  • INTERFACE CHANGES:
  • The 'o/O' hotkeys have been reassigned to navigate through log messages that have a matching "opid" field. The old action of moving forward and backward by 60 minutes can be simulated by using the ':goto' command with a relative time and the 'r/R' hotkeys.
  • Log messages with timestamps that pre-date previous log messages will have the timestamp highlighted in yellow and underlined. These out- of-time-order messages will be assigned the time of the previous message for sorting purposes. You can press the 'p' hotkey to examine the 'Received Time' of the message as well as the time parsed from the original message. A "log_actual_time" hidden field has also been added to the SQLite virtual table so you can operate on the original message time from the file.
  • The 'A/B' hotkeys for moving forward/backward by 10% line increments have been reassigned to '[' and ']'. The 'a' and 'A' hotkeys are now used to return to the previously popped view while trying to preserve the time range. For example, after leaving the spectrogram view with 'q', you can press 'A' return to the view with the top time in the spectrogram matching the top time in the log view.
  • The 'Q' hotkey now pops the current view off of the stack while maintaining the top time between views.
  • FIXES:
  • Issues with tailing JSON logs have been fixed.
  • The jget() SQL function should now work for objects nested in arrays.

New in lnav 0.8.0 (May 31, 2016)

  • Features:
  • Integration with "papertrailapp.com" for querying and tailing server log and syslog messages. See the Papertrail section in the online help for more details.
  • Remote files can be opened when lnav is built with libcurl v7.23.0+
  • SQL queries can now be done on lines that match a regular expression using the "log_search" table or by creating custom tables with the ":create-search-table" command.
  • Log formats that are "containers" for other log formats, like syslog, are now supported. See the online help for more information.
  • Formats can be installed from git repositories using the '-i' option. A standard set of extra formats can be installed by doing 'lnav -i extra'. (You must have git installed for this to work.)
  • Added support for 'VMware vSphere Auto Deploy' log format.
  • Added a 'sudo' log format.
  • Added hotkeys to move left/right by a smaller increment (H/L or Shift+Left/Shift+Right).
  • A color-coded bar has been added to the left side to show where messages from one file stop and messages from another file start.
  • The '-C' option will now try to check any specified log files to make sure the format(s) match all of the lines.
  • Added an "all_logs" SQLite table that contains the message format extracted from each log line. Also added a ';.msgformat' SQL command that executes a query that returns the counts for each format and the first line where the format was seen.
  • Added an "lnav_views" SQLite table that can be used to query and change the lnav view state.
  • When typing in a command, the status bar will display a short summary of the currently entered command.
  • Added a "delete-filter" command.
  • Added a "log_msg_instance" column to the logline and log_search tables to make it easier to join tables that are matching log messages that are ordered.
  • Added a "timeslice()" function to SQLite so that it is easier to group log messages by time buckets.
  • The 'goto' command now supports relative time values like 'a minute ago', 'an hour later', and many more.
  • Interface Changes:
  • The 'r/R' hotkeys have been reassigned to navigate through the log messages by the relative time value that was last used with the 'goto' command.
  • Fixes:
  • The pretty-print view should now work for text files.
  • Nested fields in JSON logs are now supported for levels, bodies, etc...
  • Tab-completion should work for quoted SQL identifiers.
  • 'lo-fi' mode key shortcut changed to CTRL+L.
  • 'redraw' shortcut removed. Relegated to just a command.
  • Fixed lnav hang in pretty-print mode while doing a dns lookup.
  • The generic log message parser used to extract data has been optimized and should be a bit faster.

New in lnav 0.7.3 (Apr 14, 2015)

  • Features:
  • Add 'pipe-to' and 'pipe-line-to' commands that pipe the currently marked lines or the current log message to a shell command, respectively.
  • Added a "pretty-print" view (P hotkey) that tries to reformat log messages so that they are easier to read.
  • Added a 'redraw' command (CTRL+L hotkey) to redraw the window in case it has been corrupted.
  • Added a 'relative-goto' command to move the current view relative to its current position.
  • Experimental support for linking with jemalloc.
  • The plain text view now supports filtering.
  • Added 'next-mark' and 'prev-mark' commands to jump to the next or previous bookmarked line (e.g. error, warning, ...)
  • Added a 'zoom-to' command to change the zoom level of the histogram view.
  • Log formats can now define their own timestamp formats with the 'timestamp-format' field.
  • Fixes:
  • Autotools scripts overhaul.
  • Added a configure option to disable linking with libtinfo. The newer versions of ncurses don't require it, however the build silently pulls it in as a dependency, if it is available on the system. This can be explicitly disabled using the '--disable-tinfo' option during configure.
  • Fixed the configure script behavior to ignore the values specified using the CFLAGS and LDFLAGS environment variables while searching for sqlite3 when '--with-sqlite3' switch was specified without the prefix.
  • The configure script now recognizes libeditline symlink'ed to masquerade as libreadline. This previously used to cause problems at compile time, specially on OS X. If you come across this error, use the '--with-readline=prefix' switch to specify the path to the correct location of libreadline.
  • The order that log formats are tried against a log file is now automatically determined so that more specific formats are tested before more general ones. The order is determined on startup based on how each format matches each other formats sample lines.
  • Command files (i.e. those executed via the '-f' flag) now support commands/queries that span more than one line.
  • Added more log levels: stats, debug2 - debug5.

New in lnav 0.7.2 (Mar 2, 2015)

  • Features:
  • Added log formats for vdsm, openstack, and the vmkernel.
  • Added a "lo-fi" mode (L hotkey) that dumps the displayed log lines to the terminal without any decorations. The write-to, write-json-to, and write-csv-to commands will also write their output to the terminal when passed '-' as the file name. This mode can be useful for copying plain text lines to the clipboard.
  • (OS X) Text search strings are copied to the system's "find" clipboard. Also, when starting a new search, the current value in the "find" clipboard can be tab-completed.

New in lnav 0.7.1 (Nov 8, 2014)

  • Features:
  • Added an 'environ' SQL table that reflects lnav's environment variables. The table can be read and written to using SQL SELECT, INSERT, UPDATE, and DELETE statements. Setting variables can be a way to use SQL query results in lnav commands.
  • Added a 'jget' SQLite function that can extract fields from a JSON-encoded value.
  • Added log formats for the OpenAM identity provider.
  • Added a 'clear-highlight' command to clear previous calls to the 'highlight' command.
  • Fixed some performance bugs in indexing JSON log formats. Loading times should be at least five times faster.
  • Filtering performance should be improved so that enabling/disabling filters should be almost instantaneous.
  • The filter-in, filter-out, and highlight commands now support tab-completion of text in the current view.
  • Add a '-i' flag that installs format files in: ~/.lnav/formats/installed

New in lnav 0.7.0 (Apr 1, 2014)

  • Features:
  • Add the '.schema' SQL command to open a view that displays the schema for the internal tables and any attached databases. If lnav was only executed with a SQLite database and no text files, this view will open by default.
  • The scroll bar now indicates the location of errors/warnings, search hits, and bookmarks.
  • The xterm title is update to reflect the file name for the top line in the view.
  • Added a "headless" mode so that you can execute commands and run SQL queries from the command-line without having to do it from the curses UI.
  • When doing a search or SQL query, any text that is currently being displayed can be tab-completed.
  • The '-H' option was added so you can view the internal help text.
  • Added the 'g/G' hotkeys to move to the top/bottom of the file.
  • Added a 'log_mark' column to the log tables that indicates whether or not a log message is bookmarked. The field is writable, so you can bookmark lines using an SQL UPDATE query.
  • Added syntax-highlighting when editing SQL queries or search regexes.
  • Added a "write-json-to" command that writes the result of a SQL query to a JSON-formatted file.
  • The "elapsed time" column now uses red/green coloring to indicate sharp changes in the message rate.
  • Added a "set-min-log-level" command to filter out log messages that are below a given level.
  • Fixes:
  • Performance improvements.
  • Multi-line filtering has been fixed.
  • A collator has been added to the log_level column in the log tables so that you can write expressions like "log_level > 'warning'".
  • The log_time datetime format now matches what is returned by "datetime('now')" so that collating works correctly.
  • If a search string is not valid PCRE syntax, a search is done for the exact string instead of just returning an error.
  • Static-linking has been cleaned up.
  • OpenSSL is no longer a requirement.
  • Alpha support for Windows/cygwin.
  • Environment variables can now be accessed in SQL queries using the syntax: $VAR_NAME
  • An internal log is kept and written out on a crash.
  • Partition bookmarks are now tracked separately from regular user bookmarks. You can start a partition with the 'partition-name' command and remove it with the 'clear-partition' command.
  • Improved display of possible matches during tab-completion in the command-prompt. The matches are now shown in a separate view and pressing tab repeatedly will scroll through the view.
  • The "open" command now does shell word expansion for file names.
  • More config directory paths have been added: /etc/lnav, $prefix/etc/lnav, and directories passed on the command-line with -I.

New in lnav 0.6.2 (Apr 1, 2014)

  • Features:
  • Word-wrap support.
  • Fixes:
  • Fix some OS X Mavericks build/runtime issues.

New in lnav 0.6.1 (Sep 11, 2013)

  • Features:
  • Support for JSON-encoded log files.
  • Fixes:
  • Some minor fixes and performance improvements.

New in lnav 0.6.0 (Sep 5, 2013)

  • Custom log formats and more builtin formats
  • Automatic extraction of data from logs
  • UI improvements, support for 256 color terminals