petit

petit is a command-line log analyzer for developers and systems administrators. It matches repetitive strings in a log (logins, cron runs, health checks, etc) and counts them. This separates the signal from the noise, leaving a short, easy read. The unusual lines stand out. It also has a whole host of other functions which make working with logs more convenient (Graphs, Word Counts, etc). Petit digests many different text formats, and it auto-selects the correct drivers (syslog, journalctl, Apache, Snort, application logs with stack traces, JSON, email). And, it has been doing all of this since 2009.

Capabilities

1. Hashing. petit --hash groups lines by what's left after numbers, IPs and timestamps are taken out, and prints each pattern once with its count. A 1500-line sshd log becomes eight lines. --fingerprint goes further and collapses whole reboots into one line. Hashing

2. Reports. --daemon, --host and --wordcount count a log by program, by machine, or by word, which shows its shape before you read a single line. Reports

3. Graphs. --graph draws the whole log over time in the terminal, choosing a column size that fits; --hgraph, --mgraph, --span 90m and friends pick a fixed window. Graphs

4. Format detection. petit frames the input into records (JSON objects, mail messages, multi-line messages with their stack traces, or lines) and votes on a driver to read them. It streams: memory follows the number of distinct patterns, not the size of the log. Reading logs

5. Python library. hash_lines(), analyze_text() and friends return the same groups as data, with no files, stdout or exits involved. Library

Quick Start

# Fedora, RHEL and rebuilds (Debian, Ubuntu and SUSE are in docs/install.md)
sudo curl -fsSLo /etc/yum.repos.d/crunchtools.repo \
    https://crunchtools.github.io/packages/rpm/crunchtools.repo
sudo dnf install petit

# Anywhere with Python 3.11+
uv tool install petit-log-crunchtools

# Or in a container
podman run --rm -v $(pwd):/data:ro,Z quay.io/crunchtools/petit --hash /data/some.log

Packages for RHEL, Fedora, Ubuntu, Debian, and Suse are also available.

Then:

petit --hash --fingerprint /var/log/messages    # what happened, minus reboots
petit --daemon /var/log/messages                 # who's talking
petit --graph /var/log/httpd/error_log           # when
grep error /var/log/messages | petit --mgraph    # when, for just the errors

History

petit started as lt, a Perl script inspired by Marcus Ranum's artificial ignorance, and became petit in August 2009. Since then:

• 2009: first shown at the Akron Linux Users Group; hosted in Subversion at eyemg
• 2010: packaged in Fedora and EPEL, then Debian; moved to crunchtools.com and presented at PyOhio
• 2010–2015: hosted on Google Code as petit-log, in Mercurial
• 2011–2019: shipped in every Ubuntu release from 11.04 to 19.10
• 2015: moved to GitHub by the Google Code exporter
• 2018–2020: dropped from Fedora, Debian and Ubuntu along with Python 2
• 2022: ported to Python 3
• 2026: moved to the crunchtools org, relicensed AGPL, back in native packages

The full timeline, with sources, is in History.

Further reading: Introduction: Petit Log Analysis Tool for Systems Administrators (video, 2009), Centralized Logging System, Analysis, and Troubleshooting (2010), Snort Alert Log: Simple Analysis and Daily Reporting with Arnold and Petit (2010), Log Analysis with Python, PyOhio 2010, Petit for Log Analysis by Jason Antman (2012), Petiti – An Open Source Log Analysis Tool for Linux SysAdmins by Aaron Kili at Tecmint (2017).

Documentation

Development

uv sync --all-extras          # dev tools: pytest, ruff, mypy
uv run pytest                 # tests
uv run ruff check src test    # lint
uv run mypy src               # types
podman build -t petit .       # container

Packages, the container image and PyPI releases are built by GitHub Actions on every GitHub release. The README demo is rendered from docs/demo/petit.tape.

License

AGPL-3.0-or-later. See COPYING.