🪵 Install Latest lnav on Debian

What is lnav?

lnav, the Logfile Navigator, is a log viewer for the terminal that merges log files from many sources into one view ordered by timestamp. Point it at a few files, a directory or a compressed archive and it works out the formats by itself (syslog, the systemd journal, Apache and nginx access logs, JSON lines and many more), interleaves the messages by time, colours errors and warnings so they stand out, and keeps following the files as they grow. From there you filter, search, jump between errors, and when a question needs more than a search, you query the log messages with SQL. It opens remote logs over ssh as easily as local ones. lnav is written in C++ by Tim Stack and is BSD-2-Clause licensed.

⚡ Key Features of lnav

📦 Installation from deb.griffo.io

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(. /etc/os-release; echo ${DEBIAN_CODENAME:-${UBUNTU_CODENAME:-$VERSION_CODENAME}}) main" | sudo tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null
sudo apt update

install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(. /etc/os-release; echo ${DEBIAN_CODENAME:-${UBUNTU_CODENAME:-$VERSION_CODENAME}}) main" | tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null
apt update

sudo apt install extrepo
sudo extrepo enable griffo
sudo apt update

# Install latest lnav (replaces the distribution's older lnav in place)
sudo apt install lnav

# Verify installation
dpkg -s lnav | grep Version

# Install latest lnav (replaces the distribution's older lnav in place)
apt install lnav

# Verify installation
dpkg -s lnav | grep Version

# Logs under /var/log are readable by root and the adm group
sudo lnav /var/log

# No rsyslog (the Debian default)? Read the systemd journal as JSON
journalctl -o json | lnav

# Your own logs need no sudo; formats are detected
lnav ~/app/logs/

# Press ? inside lnav for the built-in help, q to quit

# Logs under /var/log are readable by root and the adm group
lnav /var/log

# No rsyslog (the Debian default)? Read the systemd journal as JSON
journalctl -o json | lnav

# Your own logs need no sudo; formats are detected
lnav ~/app/logs/

# Press ? inside lnav for the built-in help, q to quit

🎯 Basic Usage Examples

Reading and following logs:

# Rotated and compressed logs open directly, as do archives
lnav /var/log/nginx/access.log.2.gz support-bundle.tar.gz

# Several sources, merged into one timeline by timestamp
lnav /var/log/nginx/ ~/app/logs/app.log

# A log on another machine, over your normal ssh setup
lnav user@host:/var/log/syslog

Filtering and SQL:

# Inside lnav: e / E jump to the next / previous error, w / W to warnings
# :filter-in error         keep only matching lines
# :filter-out healthcheck  hide matching lines
# ;SELECT c_ip, count(*) AS hits FROM access_log GROUP BY c_ip ORDER BY hits DESC

# The same query without the interface, for scripts
lnav -n -c ';SELECT sc_status, count(*) FROM access_log GROUP BY sc_status' /var/log/nginx/access.log

Keeping it current:

# lnav updates with the rest of the system
sudo apt update && sudo apt upgrade

# Which version is installed, and which is the newest available
apt policy lnav

# Remove it again
sudo apt remove lnav

# lnav updates with the rest of the system
apt update && apt upgrade

# Which version is installed, and which is the newest available
apt policy lnav

# Remove it again
apt remove lnav

🚀 Why Choose deb.griffo.io?

• ✅ Same Package Name as Debian: the package is lnav, exactly what the Debian archive calls it, so this repository upgrades the stock lnav in place on apt upgrade and a later apt remove leaves nothing behind
• ✅ The Official Static Build: upstream's own static musl binary, so it has no runtime dependencies at all and behaves the same on every suite
• ✅ Complete Package: the lnav binary and its man page, with openssh-client recommended for remote logs and wl-clipboard or xclip suggested for copying lines
• ✅ Automatic Updates: packages updated within hours of upstream releases
• ✅ Two Architectures: amd64 and arm64 on every suite, so the same lnav runs on servers, laptops and ARM boards like the Raspberry Pi
• ✅ Multi-Distribution: works on Bookworm, Trixie, Forky and Sid
• ✅ Easy Maintenance: standard apt commands for updates

📦 Package Build Repository

The Debian packages are automatically built and maintained in this GitHub repository:

• 🪵 lnav-debian - Latest release builds

🔗 Related Packages

Also available from deb.griffo.io:

• lazydocker - A terminal UI for Docker, to find the container whose logs you need
• k9s - A terminal UI for Kubernetes clusters and their pods
• ripgrep - Fast recursive search, for grepping a whole log tree at once
• bottom - A system monitor for the terminal, for what the logs do not tell you
• fzf - A fuzzy finder for picking the log file to open