Smart discovery
Find logs by service name, path, process, PID, or port.
SRE-native log CLI
One command for logs.
Discover, classify, search, and follow local application, system, database, web, network, and container logs without remembering paths or chaining tail, grep, find, and journalctl. Humans keep control of the diagnosis.
$
brew install logc
*Homebrew installation is under construction.
Open sourceAlways freeCLI-firstLinux & macOS
logc://local/session
$ logc [app/api] /srv/api/log/app.log [shown 13:49:12] 2026-08-08 13:47:32 INFO [http] request_id=8f1a9 GET /v1/users 200 34ms 2026-08-08 13:48:03 WARN [db] slow query detected 512ms 2026-08-08 13:49:11 ERROR [http] request_id=8f1aa upstream timeout after 30s 2026-08-08 13:49:12 INFO [retry] retrying request_id=8f1aa attempt=1 -- following -- (press Ctrl+C to stop) [app/worker] /srv/worker/log/worker.log [shown 13:49:12] 2026-08-08 13:48:42 INFO job=invoice-882 picked_up 2026-08-08 13:49:02 WARN queue_depth=842 threshold=800 [web/nginx] /var/log/nginx/access.log [shown 13:49:12 · logrotate] 10.0.2.14 - GET /api/payments 200 42ms 10.0.2.18 - POST /api/payments 201 218ms
3 active files · fairly aggregated · following
(live) ●
A clearer incident workflow
From shell fragments to one focused command.
Start with the service and symptom you know. logc handles discovery, recent-log search, and live follow-up in a single workflow.
Before
$ find /srv -name '*.log' $ grep -Ei 'timeout|reset' ... $ zgrep -Ei 'timeout|reset' *.log.gz $ tail -f app.log | grep ERROR
→
After
$ logc api 'timeout|reset' --since 30m -f
Less path-hunting. Less command memorization. Faster debugging.
Built around the way SREs debug
A local-first toolkit for finding the right log source, narrowing to the signal, and staying with the live stream.
Latest logs first
Search the recent 24-hour window by default, choose a precise --since window, or explicitly request --all.
Follow live
Search history, then continue following new matching lines.
System aware
Works with files, journald, and common Linux log sources. Full system history uses journald on Linux.
Noise control
Ignore health checks, dedupe spam, and keep hot logs from flooding the screen.
Open source forever
Open development. Free to use, now and always.
Complete command guide
Every command form, ordered exactly like the CLI help. Each form uses one practical example so you can move from discovery to a focused live stream without learning a new query language.
01logc — discover and follow
Use when you have just opened an unfamiliar host and need an immediate overview.
$ logc [app/api] /srv/api/log/app.log [shown 14:21:09 · logrotate] 14:21:01 INFO server started 14:21:09 WARN database latency=421ms [web/nginx] /var/log/nginx/access.log [shown 14:21:09 · logrotate] 14:21:03 INFO 200 GET /health 1ms -- following new lines --
02logc TARGET — follow one source
Use a source name when you know the service but do not want to remember its exact file paths.
$ logc api [app/api] /srv/api/log/app.log [shown 14:24:18 · logrotate] 14:24:16 INFO GET /v1/orders 200 42ms 14:24:18 WARN retry budget remaining=2 -- following -- TARGET also accepts a file, directory, glob, @process, @PID, or :port.
03logc TARGET REGEX — search a source
Use when you know the service and symptom but not which active, rotated, or compressed file contains it.
$ logc payment ERROR --since 30m -C 2 [app/payment] /srv/payment/log/app.log [shown 14:25:02 · 1 match · logrotate] 14:24:58 INFO authorizing charge 14:25:01 ERROR upstream timeout request_id=9d2b1 14:25:02 INFO retrying attempt=1 [app/payment] /srv/payment/log/app.log.1.gz [shown 14:25:02 · 1 match · logrotate] 14:02:55 ERROR settlement rejected code=42
04logc REGEX — search recent machine logs
Use when you know the symptom but do not yet know which application produced it.
$ logc ERROR [app/api] /srv/api/log/app.log [shown 14:26:31 · 2 matches · logrotate] 14:26:02 ERROR connection reset by peer 14:26:31 ERROR upstream timeout after 30s [app/worker] /srv/worker/log/worker.log [shown 14:26:31 · 1 match] 14:25:44 ERROR queue unavailable 3 matching lines · recent 24h
05logc TARGET REGEX -f — search, then follow
Use when an incident began recently and you want historical context plus new matching events.
$ logc api 'timeout|reset' --since 30m -f [app/api] /srv/api/log/app.log.1.gz [shown 13:49:11 · 1 match · logrotate] 13:36:45 ERROR upstream timeout after 30s [app/api] /srv/api/log/app.log [shown 13:49:11 · 1 match · logrotate] 13:49:11 ERROR upstream timeout after 30s -- following matching lines -- 13:50:02 WARN connection reset by peer
06logc watch REGEX [TARGET...]
Use when repeated errors scroll too quickly and you need rate, count, and timing instead of every raw line.
$ logc watch ERROR api --since 30m logc watch "ERROR" [13:50:03] 2 alert groups · 7 events/min · 3 sources COUNT FIRST LAST SOURCE ALERT 12 13:42:02 13:49:11 app/api/app.log [R] ERROR upstream timeout 4 13:45:18 13:49:44 app/worker/worker.log ERROR queue reset Refreshes every second · [R] means logrotate-managed
07logc system [REGEX]
Use when the failure may involve systemd, the kernel, networking, or another host-level service.
$ logc system ERROR --since 30m 2026-08-08 14:22:31 host kernel: ERROR eth0 transmit timeout 2026-08-08 14:22:38 host systemd[1]: api.service failed with result 'exit-code' -- following system logs -- Use --kernel for the kernel-only stream.
08logc docker [OPTIONS] NAME
Use Docker's native log options while retaining logc filtering, deduplication, color, and JSON output.
$ logc docker --tail 100 --timestamps api 2026-08-08T14:31:04.812Z INFO api listening on :8080 2026-08-08T14:31:19.441Z WARN database latency=421ms 2026-08-08T14:31:24.109Z ERROR upstream timeout request_id=req-8f1aa -- following Docker logs -- Docker options are forwarded directly to docker logs.
09logc ls [FILTERS] — inspect sources
Use before an incident to see what logc discovered, how it classified each source, and whether logrotate manages it.
$ logc ls --category web ID CATEGORY MODULE TYPE FILES LATEST ROTATE LOCATION web/nginx web nginx auto 2 4s yes /var/log/nginx web/haproxy web haproxy auto 3 2m partial /var/log/haproxy ROTATE: yes · partial · -
10logc where TARGET — resolve paths
Use when you want to verify exactly which files a named, discovered, process, PID, or port target resolves to.
$ logc where web/nginx /var/log/nginx/access.log [logrotate] /var/log/nginx/error.log [logrotate] Read-only path resolution. No files are changed.
11logc config — inspect configuration
Use to create, locate, or inspect the effective roots, exclusions, groups, limits, and output settings.
$ logc config show config=/home/sre/.logc.conf default_log_dir=/var/log exclude=/var/log/journal/** [group.mysql] category=database path=/var/log/mysql/*.log Also available: config init · config path
12logc help / version
Use these stable utility commands to inspect the installed CLI syntax and build version.
$ logc version logc v0.2.0 (linux/amd64) $ logc --help logc — one command for local logs USAGE logc logc TARGET logc TARGET REGEX ...