Loggia

An interactive log viewer for the terminal

Loggia is a terminal application for interactively following and inspecting a system's event log files, such as syslog and webserver access logs. The main goal of Loggia is to provide a consolidated event console showing data from several sources, colorized to make it easier for the human eye to spot patterns.

Loggia is created to serve the author's own needs and is released to the public under the MIT license. Contributions are accepted subject to the same license. Please refer to the file LICENSE for the complete license.

Features

View logs from several files with entries merged in temporal order.
Parse file content for timestamps upon first read, so past events are presented in correct order.
Follow files: display updates as soon as log entries are written.
Detect rotated logs, decompress archives.
Extensible with new timestamp formats, log formats, etc.
Runtime-reloadable configuration for easy adaptation to new log formats.
Powerful colorization: see the self-explaining sample config file loggia.conf.
Interactive search.
Runtime-settable event retention: auto-discard oldest events by capping total event count, maximum event age, or both.
Runs on multiple UNIX-like operating systems (Linux, OpenBSD), multiple Common Lisp implementations (SBCL and CCL) and multiple architectures (amd64, arm64, armv7).
Small, portable program written in Common Lisp.

Status

Loggia is used in production and can be considered stable. Not all planned features are implemented yet. All documented aspects are subject to change.

Dependencies

Loggia depends on a couple Common Lisp libraries accessible via QuickLisp:

cl-charms for Ncurses integration, which in turn depends on the presence of the ncurses development library (libncurses-dev or similar).
cl-ppcre for regular expression support.
clsql-sqlite3 for SQLite integration (this depends on the presence of libsqlite3-dev or similar).

In addition, Loggia depends on the Barium project for some of its base platform facilities (the barium-base system, which itself does not depend on the presence of any graphical system or library). Barium is not (yet) available via QuickLisp; see the link for installation instructions.

Installation

Assuming SBCL or CCL on Linux with Quicklisp already set up:

Clone the Barium source repository at https://git.hq.sig7.se/barium.git
Clone the Loggia source repository at https://git.hq.sig7.se/loggia.git
Create symlinks to them from ~/quicklisp/local-projects.
Run ./build-sbcl.sh (or equivalent)

First time you do this, you might find yourself in the Lisp debugger invoked by QUICKLISP-CLIENT:SYSTEM-NOT-FOUND. Note the restart called REGISTER-LOCAL-PROJECTS. Select it and you should be fine.
Run and manually install the resulting executable.
Optionally, copy loggia.conf to ~/.config/.

Usage

The program's invocation is simple: just pass all log files as arguments. Example:

loggia /var/log/nginx/*.log /var/log/*.log /var/log/syslog

Once the UI appears, press ? to bring up a help window to see keyboard shortcuts.

Colors

For best results, a terminal supporting 256 colors is required. Ensure that $TERM is set accordingly, e.g., xterm-256color or (inside tmux) screen-256color.

Development setup

Because Loggia is an ncurses application, it needs a real terminal. However, it is still desirable to receive debug printouts in the SLIME repl. To achieve this, first start a real terminal and issue these commands:

$ sbcl
(ql:quickload 'swank :silent t)
(swank:create-server :port 4005 :dont-close t)
(loop (sleep 1))

Or as a one-liner:

sbcl --eval "(ql:quickload :swank :silent t)" --eval "(swank:create-server :port 4005 :dont-close t)" --eval "(loop (sleep 1))"

Now connect from SLIME:

M-x slime-connect Host: localhost Port: 4005

Then, in the SLIME repl, execute:

(ql:quickload :loggia)
(loggia:main <input1> <input2> ...)

Building an executable

The scripts build-sbcl.sh and build-ccl*.sh (the latter has variants) will build a self-contained executable on top of SBCL or CCL.