petit

petit is a command-line log analyzer for systems administrators. It takes out of a log everything that repeats (the routine logins, the cron runs, the health checks) and counts it, so what's left to read is short and the unusual lines stand out. It works out the format on its own (syslog, journalctl, Apache, Snort, application logs with stack traces, JSON, mail), draws activity graphs in the terminal, and does the same from Python. It has been doing this since 2009.

Capabilities

1. Hashing. petit --hash groups lines by what's left after numbers, IPs and timestamps are taken out, and prints each pattern once with its count. A 1500-line sshd log becomes eight lines. --fingerprint goes further and collapses whole reboots into one line. Hashing

2. Reports. --daemon, --host and --wordcount count a log by program, by machine, or by word, which shows its shape before you read a single line. Reports

3. Graphs. --graph draws the whole log over time in the terminal, choosing a column size that fits; --hgraph, --mgraph, --span 90m and friends pick a fixed window. Graphs

4. Format detection. petit frames the input into records (JSON objects, mail messages, multi-line messages with their stack traces, or lines) and votes on a driver to read them. It streams: memory follows the number of distinct patterns, not the size of the log. Reading logs

5. Python library. hash_lines(), analyze_text() and friends return the same groups as data, with no files, stdout or exits involved. Library

Quick Start

# Fedora, RHEL and rebuilds (Debian, Ubuntu and SUSE are in docs/install.md)
sudo curl -fsSLo /etc/yum.repos.d/crunchtools.repo \
    https://crunchtools.github.io/packages/rpm/crunchtools.repo
sudo dnf install petit

# Anywhere with Python 3.11+
uv tool install petit-log-crunchtools

# Or in a container
podman run --rm -v $(pwd):/data:ro,Z quay.io/crunchtools/petit --hash /data/some.log

Then:

petit --hash --fingerprint /var/log/messages    # what happened, minus reboots
petit --daemon /var/log/messages                 # who's talking
petit --graph /var/log/httpd/error_log           # when
grep error /var/log/messages | petit --mgraph    # when, for just the errors

History

petit started as lt, a Perl script inspired by Marcus Ranum's artificial ignorance, and became petit in August 2009. Since then:

• 2009: first shown at the Akron Linux Users Group; hosted in Subversion at eyemg
• 2010: packaged in Fedora and EPEL, then Debian; moved to crunchtools.com and presented at PyOhio
• 2010–2015: hosted on Google Code as petit-log, in Mercurial
• 2011–2019: shipped in every Ubuntu release from 11.04 to 19.10
• 2015: moved to GitHub by the Google Code exporter
• 2018–2020: dropped from Fedora, Debian and Ubuntu along with Python 2
• 2022: ported to Python 3
• 2026: moved to the crunchtools org, relicensed AGPL, back in native packages

The full timeline, with sources, is in History.

Further reading: Introduction: Petit Log Analysis Tool for Systems Administrators (video, 2009), Centralized Logging System, Analysis, and Troubleshooting (2010), Snort Alert Log: Simple Analysis and Daily Reporting with Arnold and Petit (2010), Log Analysis with Python, PyOhio 2010, Petit for Log Analysis by Jason Antman (2012), Petiti – An Open Source Log Analysis Tool for Linux SysAdmins by Aaron Kili at Tecmint (2017).

Documentation

Development

uv sync --all-extras          # dev tools: pytest, ruff, mypy
uv run pytest                 # tests
uv run ruff check src test    # lint
uv run mypy src               # types
podman build -t petit .       # container

Packages, the container image and PyPI releases are built by GitHub Actions on every GitHub release. The README demo is rendered from docs/demo/petit.tape.

License

AGPL-3.0-or-later. See COPYING.