Metadata-Version: 2.5
Name: petit-log-crunchtools
Version: 4.10.2
Summary: Log analysis for systems administrators — detects the log format, then collapses the repetitive into counts so the unusual is what you read
Project-URL: Homepage, https://github.com/crunchtools/petit
Project-URL: Source, https://github.com/crunchtools/petit
Project-URL: Changelog, https://github.com/crunchtools/petit/blob/master/CHANGELOG.md
Author-email: Scott McCarty <scott.mccarty@gmail.com>
License-Expression: AGPL-3.0-or-later
License-File: COPYING
Keywords: analysis,apache,deduplication,log,sysadmin,syslog
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: System :: Logging
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.11
Provides-Extra: dev
Requires-Dist: mypy>=1.13; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.8; extra == 'dev'
Description-Content-Type: text/markdown

<p align="center">
  <img src="https://raw.githubusercontent.com/crunchtools/petit/master/docs/images/petit-logo.png" alt="petit: a brass log press turning a long column of log text into a short slip" width="320">
</p>

# petit

petit is a command-line log analyzer for developers and systems administrators.
It matches repetitive strings in a log (logins, cron runs, health checks, etc)
and counts them. This separates the signal from the noise, leaving a short, easy
read. The unusual lines stand out. It also has a whole host of other functions
which make working with logs more convenient (Graphs, Word Counts, etc). Petit
digests many different text formats, and it auto-selects the correct drivers
(syslog, journalctl, Apache, Snort, application logs with stack traces, JSON,
email). And, it has been doing all of this since 2009.

<p align="center">
  <img src="https://raw.githubusercontent.com/crunchtools/petit/master/docs/demo/petit.gif" alt="Terminal demo: a 1500-line sshd log hashed to 8 lines, then graphed, then reported by daemon and by word" width="800">
</p>

## Capabilities

1. **Hashing.** `petit --hash` groups lines by what's left after numbers,
   IPs and timestamps are taken out, and prints each pattern once with its
   count. A 1500-line sshd log becomes eight lines. `--fingerprint` goes
   further and collapses whole reboots into one line. [Hashing](https://github.com/crunchtools/petit/blob/master/docs/hashing.md)

2. **Reports.** `--daemon`, `--host` and `--wordcount` count a log by
   program, by machine, or by word, which shows its shape before you read a
   single line. [Reports](https://github.com/crunchtools/petit/blob/master/docs/reports.md)

3. **Graphs.** `--graph` draws the whole log over time in the terminal,
   choosing a column size that fits; `--hgraph`, `--mgraph`, `--span 90m`
   and friends pick a fixed window. [Graphs](https://github.com/crunchtools/petit/blob/master/docs/graphs.md)

4. **Format detection.** petit frames the input into records (JSON objects,
   mail messages, multi-line messages with their stack traces, or lines)
   and votes on a driver to read them. It streams: memory follows the number
   of distinct patterns, not the size of the log. [Reading logs](https://github.com/crunchtools/petit/blob/master/docs/reading-logs.md)

5. **Python library.** `hash_lines()`, `analyze_text()` and friends return
   the same groups as data, with no files, stdout or exits involved.
   [Library](https://github.com/crunchtools/petit/blob/master/docs/library.md)

## Quick Start

```bash
# Fedora, RHEL and rebuilds (Debian, Ubuntu and SUSE are in docs/install.md)
sudo curl -fsSLo /etc/yum.repos.d/crunchtools.repo \
    https://crunchtools.github.io/packages/rpm/crunchtools.repo
sudo dnf install petit

# Anywhere with Python 3.11+
uv tool install petit-log-crunchtools

# Or in a container
podman run --rm -v $(pwd):/data:ro,Z quay.io/crunchtools/petit --hash /data/some.log
```
Packages for RHEL, Fedora, Ubuntu, Debian, and Suse are [also available](https://crunchtools.github.io/packages/).

Then:

```bash
petit --hash --fingerprint /var/log/messages    # what happened, minus reboots
petit --daemon /var/log/messages                 # who's talking
petit --graph /var/log/httpd/error_log           # when
grep error /var/log/messages | petit --mgraph    # when, for just the errors
```

## History

petit started as `lt`, a Perl script inspired by Marcus Ranum's
[artificial ignorance](https://www.ranum.com/security/computer_security/papers/ai/),
and became petit in August 2009. Since then:

- **2009**: first shown at the Akron Linux Users Group; hosted in Subversion at eyemg
- **2010**: packaged in Fedora and EPEL, then Debian; moved to crunchtools.com and
  presented at PyOhio
- **2010–2015**: hosted on Google Code as `petit-log`, in Mercurial
- **2011–2019**: shipped in every Ubuntu release from 11.04 to 19.10
- **2015**: moved to GitHub by the Google Code exporter
- **2018–2020**: dropped from Fedora, Debian and Ubuntu along with Python 2
- **2022**: ported to Python 3
- **2026**: moved to the crunchtools org, relicensed AGPL, back in native packages

The full timeline, with sources, is in [History](https://github.com/crunchtools/petit/blob/master/docs/history.md).

**Further reading:**
[Introduction: Petit Log Analysis Tool for Systems Administrators](https://www.youtube.com/watch?v=5hI5sUPuzGc) (video, 2009),
[Centralized Logging System, Analysis, and Troubleshooting](https://crunchtools.com/centralizing-log-files/) (2010),
[Snort Alert Log: Simple Analysis and Daily Reporting with Arnold and Petit](https://crunchtools.com/log-analysis-simple-breakdown-of-snort-alert-log-with-arnold/) (2010),
[Log Analysis with Python, PyOhio 2010](https://archive.org/details/pyvideo_514___pyohio-2010-log-analysis-with-python),
[Petit for Log Analysis](https://blog.jasonantman.com/2012/02/petit-for-log-analysis/) by Jason Antman (2012),
[Petiti – An Open Source Log Analysis Tool for Linux SysAdmins](https://www.tecmint.com/petiti-log-analysis-tool-for-linux-sysadmins/) by Aaron Kili at Tecmint (2017).

## Documentation

| Page | What it covers |
|------|----------------|
| [Install](https://github.com/crunchtools/petit/blob/master/docs/install.md) | Native packages for Fedora, RHEL, SUSE, Debian and Ubuntu; PyPI; container |
| [Hashing](https://github.com/crunchtools/petit/blob/master/docs/hashing.md) | `--hash`, samples, filters, `--fingerprint`, `--identifiers` |
| [Reports](https://github.com/crunchtools/petit/blob/master/docs/reports.md) | `--daemon`, `--host`, `--wordcount` |
| [Graphs](https://github.com/crunchtools/petit/blob/master/docs/graphs.md) | Every graph, its units, window and width |
| [Reading logs](https://github.com/crunchtools/petit/blob/master/docs/reading-logs.md) | Framers, drivers, big inputs, multi-line messages, JSON |
| [Library](https://github.com/crunchtools/petit/blob/master/docs/library.md) | The Python API and what SemVer covers |
| [Philosophy](https://github.com/crunchtools/petit/blob/master/docs/philosophy.md) | Why petit removes certainty and leaves uncertainty |
| [History](https://github.com/crunchtools/petit/blob/master/docs/history.md) | Where petit has lived since 2009, and what's been written about it |
| [Writing and tuning drivers](https://github.com/crunchtools/petit/blob/master/docs/internal/drivers.md) | For contributors: framers, entry and hash drivers, stopwords, reboot corpora |

## Development

```bash
uv sync --all-extras          # dev tools: pytest, ruff, mypy
uv run pytest                 # tests
uv run ruff check src test    # lint
uv run mypy src               # types
podman build -t petit .       # container
```

Packages, the container image and PyPI releases are built by GitHub Actions
on every GitHub release. The README demo is rendered from
[docs/demo/petit.tape](https://github.com/crunchtools/petit/blob/master/docs/demo/petit.tape).

## License

AGPL-3.0-or-later. See [COPYING](https://github.com/crunchtools/petit/blob/master/COPYING).
