Command Line Interface

There are two command-line interfaces provided by lnav, one for viewing files and one for managing lnav’s configuration. The file viewing mode is the default and is all that most people will need. The management mode can be useful for those that are developing log file formats and is activated by passing the -m option as the first argument.

File Viewing Mode

The following options can be used when starting lnav. There are not many flags because the majority of the functionality is accessed using the -c option to execute commands or SQL queries.



Print these command-line options and exit.


Start lnav and switch to the help view.


Check the given files against the configuration, report any errors, and exit. This option can be helpful for validating that a log format is well-formed.

-c <command>

Execute the given lnav command, SQL query, or lnav script. The argument must be prefixed with the character used to enter the prompt to distinguish between the different types (i.e. ‘:’, ‘;’, ‘|’). This option can be given multiple times.

-f <path>

Execute the given command file. This option can be given multiple times.

-I <path>

Add a configuration directory.


Install the format files in the .lnav/formats/ directory. Individual files will be installed in the installed directory and git repositories will be cloned with a directory name based on their repository URI.


Update formats installed from git repositories.

-d <path>

Write debug messages to the given file.


Run without the curses UI (headless mode).


Do not open the default syslog file if no files are given.


Recursively load files from the given base directories.


Prepend timestamps to the lines of data being read in on the standard input.

-w <path>

Write the contents of the standard input to this file.


Print the version of lnav.


Do not print the log messages after executing all of the commands.

Management Mode (v0.11.0+)

The management CLI mode provides functionality for query lnav’s log format definitions.



Switch to management mode. This must be the first option passed on the command-line.


regex101 import <regex101-url> <format-name> [<regex-name>]

Convert a entry into a skeleton log format file.

format <format-name> regex <regex-name> push

Push a log format regular expression to .

format <format-name> regex <regex-name> pull

Pull changes to a regex that was previously pushed to .

Environment Variables


If this variable is set, lnav will use this directory to store its configuration in a sub-directory named lnav.


If XDG_CONFIG_HOME is not set, lnav will use this directory to store its configuration in a sub-directory named .lnav.


On Windows, lnav will use this directory instead of HOME to store its configuration in a sub-directory named .lnav.


The timezone setting is used in some log formats to convert UTC timestamps to the local timezone.


To load and follow the system syslog file:


To load all of the files in /var/log:

lnav /var/log

To watch the output of make with timestamps prepended:

make 2>&1 | lnav -t