Terminal: What app do you to see a .log file through pagination and with colors?

Applications
1

Hello Friends

In a Terminal:

  • What app do you to see a .log file through pagination and with colors?

I did do a quick research in the web and I found https://lnav.org/ (not tested yet) But just being curious if you have your own recommendation. It to be used with https://logback.qos.ch where is used the following Logger Levels: trace,debug,info,warn,error

If I use Visual Studio Code for long files (20MB-50MB) it consumes ram as a wolf, it even worst for many .log files opened at the same time. Therefore through the terminal I need use:

  • Pagination
  • Colors (to highlight each Logger Level)

Thanks in advance!

4 Likes
2

I use vi on log files.
If it is vim it will color.
With vi you can search too… that is what I find useful.

For typescript log files ( output from script command) use this

or,
dewtall’s script… found here

5 Likes
3

I have used lnav and found it somewhat useful. I usually end up just using grep filters to find what I’m looking for though.

5 Likes
4

Only if it’s a recognised format…

I wouldn’t recommend “vi”…

You can use “view” which is just an alias to “vi” but opens in readonly mode :smiley:

I’d rather use “less” than either of above… It also uses vi navigation - it’s like “more” but you can scroll up and down… and you can use “vi” style searching (with “/”) - and “:q” to exit… I don’t know if there’s an equivalent in nano (but out of the box - nano doesn’t seem to do colour / highlighting on log files)…

If it’s a file that has some recognisable formatting - I’d recommend “bat”…

I just checked out vi, view, less and bat on /var/log/kern.log

Less does NOT show highlighting / colours - but vi, vim and view all do (highlighting) - as does “bat”. By default “bat” also shows line numbers…

You can easily install bat on most debian/ubuntu systems with “sudo apt install bat”…

Screenshots :

bat on /var/log/kern.log :

Screenshot from 2025-09-19 10-03-20
Screenshot from 2025-09-19 10-03-201425Ă—722 315 KB

“view” on /var/log/kern.log :

Screenshot from 2025-09-19 10-03-34
Screenshot from 2025-09-19 10-03-341425Ă—722 330 KB

But me? I don’t really need syntax highlighting on log files - I’m mostly just looking for specific strings…

In fact I hardly ever open a whole log file - if I know what I’m looking for - I’ll use grep, or egrep (note : grep usually highlights your word [on my Ubuntu in red] in the strings that match your search criteria)… And this is a lesson I learned when troubleshooting something with log files that are MILLIONS of lines long - you can wait minutes for the whole thing to load… better to use grep (e.g. you could even grep a date/time range).

I find “bat” more useful for shell scripts / code, than log files…

5 Likes
5

I think what vi does with color depends on what you have for vi in update-alternatives.l
Less will search
Bat is an enhaced cat, as I undsrstand it.

I must admit my use of vi is habit. View is not always available, and its name clashes with some other editor… MC I think. But, yes, view is a good idea especially for looking at config files.

4 Likes
6

I’ve never found a system - even ancient Solaris 8 - that didn’t have an alias (systemwide) to “view” (runs vi in read only mode).

I have VERY occasionally come across systems that didn’t have “vipw” or “vigr” - probably stripped down barebones minimal installs of Solaris (earlier than 10)… Never got around to investigate if they had the alias “view”…

That’s what annoys the crap out of me on Debian (and thus Ubuntu) “visudo” SHOULD launch “vi” that’s why it’s “VIsudo” - but no - they default to nano without even asking you (crontab -e does ask on Debian / Ubuntu). So one of the first things I nearly always do on a new Ubuntu or Debian install “echo "EDITOR=vi" >> /etc/environment” and also “export EDITOR=vi” - before running “visudo”…

Note: just did some digging - “vipw” is not an alias or a symlink - it’s a binary! I never knew that!

╭─x@titanii ~  
╰─➤  file /usr/sbin/vipw
/usr/sbin/vipw: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=e38bcf7c98ddbb35b06e9e4b63b1e066a9b13efb, for GNU/Linux 3.2.0, stripped

learn something new every day :smiley:

“vigr” is however - a symlink to vipw…

“view” is a symlink to vim.tiny on Ubuntu, but “vim.basic” on Debian Bookworm…

Further digging - what’s true on Debian / Ubuntu is often false on other distro families… e.g. on Red Hat 9, “view” is a shell script that runs vi in readonly mode :

[x@plangyfanny ~]$ cat /usr/bin/view
#!/usr/bin/sh

# run vim -R if available
if test -f /usr/bin/vim
then
  exec /usr/bin/vim -R "$@"
fi

# run vi otherwise
exec /usr/libexec/vi -R "$@"

And on Artix (I assume it inherits this from Arch) - “view” is a symlink to “ex”

cunarstrix:[x]:~$ which view
/usr/bin/view
cunarstrix:[x]:~$ file /usr/bin/view
/usr/bin/view: symbolic link to ex
cunarstrix:[x]:~$

Interesting stuff (to me anyway) hopefully I haven’t derailed OP’s topic :smiley: - but I find it easier to apologise later than ask permission :smiley: …

Did some more digging - “vipw” will use your $EDITOR to edit the file in locked mode… I haven’t tried to run “vipw” on a system where I didn’t have “vi” as the default editor… So I just had a play - on my Ubuntu 24.04 - as root - if I “export EDITOR=nano” then run vipw, it opens /etc/passwd in nano… So I learned something else today :smiley:

5 Likes
7

Have a look at my current Alpine.

1 Like
8

Huge thanks to all for the replies …

I am going to research each option soon as I can

a happy place to share thoughts and experiences in peace

:clinking_beer_mugs: to all

4 Likes
9

@Manuel_Jordan :

Hi Manuel, :waving_hand:

I´ve been using lnav for quite a while and I like it a lot.
Coloured output comes in handy e.g. when looking for error messages.
Some info from ubuntuusers wiki:

Support of common log formats, including automatic unpacking compressed log files or directories

Color formatting to distinguish, for example, info, warnings and error messages at a glance

Automatic display of new entries in real time

Monitor multiple log files at once

Filter and search functions

Start SQL queries

Besides running the simple command lnav, which defaults to /var/log/syslog I also used
lnav /var/log/kern.log
and
lnav /var/log/syslog.3.gz
in the past.

The latter one is interesting as (already mentioned above) you don´t need to unpack compressed log files in advance in order to view them. lnav can handle them by itself. :wink:

One thing to take care of (for convenience): Toggle “CTRL+W” interactively in order to switch Line Break on/off.

Many greetings from Rosika :slightly_smiling_face:

6 Likes
10

@Rosika , @Manuel_Jordan

That is by far the best suggestion. … as long as it can search thru old logfiles.

5 Likes
11

I just tried lnav - which I don’t recall hearing or reading about before…

I like the way it handles gz log files too! It’s also very useful for my home systems - and I can even use it to read “ordinary” text files… e.g. notes I’ve written with # lines meant to be commented…

I probably won’t use it at work - most of the systems I manage aren’t subscribed to any repos like epel or whatever (they nearly all RHEL or OEL) - so I won’t ever be able to count on it being there…

In those cases I’ll continue to use grep …

6 Likes
12

In some distros you can not even count on log files being there. Void and Alpine have a bare minimum of logs.

4 Likes
13

See, whereas I have LESSOPEN="||/usr/bin/lesspipe.sh %s" set in my environment, which ensures that anything opened in or piped to less will get redirected to a vim -R (readonly) session instead.

Because less offers only a paltry imitation of real vim navigation.

  1. vim syntax-highlights almost anything, with the right settings. (/bin/less /etc/passwd => monochrome; vim -R /etc/passwd, glorious color.)
  2. Like vim, less allows the use of regexp search by typing a /, but vim not only highlights all of the visible matches in realtime as you edit the expression, but it’ll scroll to the first one automatically if it’s not visible. less waits for you to hit Enter to even start navigating.
  3. less does a passable imitation of vim’s vertical navigation controls, but it doesn’t give you a cursor and it doesn’t allow horizontal navigation within a line of text. vim does, even in read-only mode.

Etc, etc.

3 Likes
14

Most logs are in the systemd journal nowadays, so journalctl is your log query command of… well, exactly the opposite of choice, but “of last resort” anyway. (It works fine except that I hate hate hate its output formatting. Horizontal scrolling is devil.)

3 Likes
15

I avoid systemd distros.
I have the philosophical objection to systemd, and I carry it out in practice, but I dont push my point of view onto others. Freedom is important , even init freedom.
One can always use syslogd, instead of systemd journal in any distro.

See replies 11,12,13 in

3 Likes
16

I have to work with systemd all day, every day - that’s my job…

But I’ll only ever run “journalctl” as a very last resort - it’s horrible… it’s nasty… it’s ugly…

Thankfully most of the stuff my customers run, while mostly being systemd aware - they still log their diarrhea in /var/log somewhere…

And it’s often part of a MOE/SOE server build - we have to replace some other logging system (e.g. systemd) with syslogd, and rsyslogd (thank you Splunk! I’m not even being sarcastic!)…

And - I’m kinda grateful - when software vendors - store ALL their binaries - and - LOGS - in a separate filesystem - e.g. /opt… that makes compartmentalising, and sandboxing, apps, from infrastructure an order of magnitude easier!

4 Likes
17

Huge thanks for the extra positive feedback @Rosika

and thanks for all for the extra information about other commands experience

4 Likes
18

@Manuel_Jordan :

Hi Manuel, :waving_hand:

you´re welcome.
I´m glad I could be of some help at all.

Many greetings from Rosika :slightly_smiling_face:

3 Likes