---
# Petit
**URL:** https://crunchtools.com/software/petit/
Date: 2010-05-03
Author: kuroda
Post Type: page
Summary: petit is a command-line log analyzer for developers and systems administrators. It matches repetitive strings in a log (logins, cron runs, health checks, etc) and counts them. This separates the signal from the noise, leaving a short, easy read. The unusual lines stand out. It also has a whole host of other functions which makeContinue Reading "Petit" →
Featured Image: https://crunchtools.com/wp-content/uploads/2010/06/petit_graphing.jpeg
---
petit is a command-line log analyzer for developers and systems administrators. It matches repetitive strings in a log (logins, cron runs, health checks, etc) and counts them. This separates the signal from the noise, leaving a short, easy read. The unusual lines stand out. It also has a whole host of other functions which make working with logs more convenient (Graphs, Word Counts, etc). Petit digests many different text formats, and it auto-selects the correct drivers (syslog, journalctl, Apache, Snort, application logs with stack traces, JSON, email). And, it has been doing all of this since 2009.
[toc]
## Install
Native packages come from the signed repositories at [crunchtools.github.io/packages](https://crunchtools.github.io/packages), so updates arrive with the rest of the system.
**Fedora, RHEL 8/9/10 and rebuilds, Amazon Linux 2023**
```
sudo curl -fsSLo /etc/yum.repos.d/crunchtools.repo \
https://crunchtools.github.io/packages/rpm/crunchtools.repo
sudo dnf install petit
```
**Debian 12 and 13, Ubuntu 24.04 and 26.04**
```
sudo install -d /etc/apt/keyrings
sudo curl -fsSLo /etc/apt/keyrings/crunchtools.asc \
https://crunchtools.github.io/packages/crunchtools.asc
sudo curl -fsSLo /etc/apt/sources.list.d/crunchtools.sources \
https://crunchtools.github.io/packages/deb/crunchtools.sources
sudo apt update && sudo apt install petit
```
**Anywhere with Python 3.11 or newer**
```
uv tool install petit-log-crunchtools
```
**Container**
```
podman run --rm -v $(pwd):/data:ro,Z quay.io/crunchtools/petit --hash /data/some.log
```
SUSE, the signing key fingerprint and the rest are in the [install guide](https://github.com/crunchtools/petit/blob/master/docs/install.md).
## Routine Operations
Hash a syslog, removing reboots. Entries seen three times or fewer print a real sample instead of the pattern.
```
petit --hash --fingerprint /var/log/messages
```
Hash an Apache log
```
petit --hash /var/log/httpd/access_log
```
Get a daemon report, or a host report
```
petit --daemon /var/log/messages
petit --host /var/log/messages
```
Find qualitatively important words in your log. This is especially useful to help determine what should be monitored.
```
petit --wordcount /var/log/messages
```
Graph the whole log, sized to the terminal
```
petit --graph /var/log/messages
```
Track a special word you are interested in by minute
```
grep error /var/log/messages | petit --mgraph
```
Keep every pattern, useful for de-duplicating lists such as source IPs
```
petit --hash --nofilter /var/log/messages
```
## Documentation
- [Hashing](https://github.com/crunchtools/petit/blob/master/docs/hashing.md): `--hash`, samples, filters, `--fingerprint`, `--identifiers`
- [Reports](https://github.com/crunchtools/petit/blob/master/docs/reports.md): `--daemon`, `--host`, `--wordcount`
- [Graphs](https://github.com/crunchtools/petit/blob/master/docs/graphs.md): every graph, its units, window and width
- [Reading logs](https://github.com/crunchtools/petit/blob/master/docs/reading-logs.md): format detection, big inputs, multi-line messages, JSON
- [Library](https://github.com/crunchtools/petit/blob/master/docs/library.md): using petit from Python
- [History](https://github.com/crunchtools/petit/blob/master/docs/history.md): the full timeline, with sources
Source code and issues: [github.com/crunchtools/petit](https://github.com/crunchtools/petit). Releases are on [PyPI](https://pypi.org/project/petit-log-crunchtools/) and in the [GitHub releases](https://github.com/crunchtools/petit/releases).
## Why
[Log analysis](http://en.wikipedia.org/wiki/Log_analysis) is something that all systems administrators know they need to do. Many of us come to this point, either because there is a problem, there is a security requirement from the organization, or it keeps you up all night wanting to know what is going on in all of that data. Looking for best practices for log analysis on the Internet is difficult at best. Many years ago, I discovered a script that hashed log files by removing all of their numbers and replacing them with "#" characters. The results of this simple algorithm were phenomenal, logs could be reduced by a factor of ten. This was much more readable, yet left much of the quality data that I needed to determine if there was a problem. In the years since I discovered that simple algorithm, I have come to discover many techniques on text analysis which are commonly used in linguistics and anthropology to analyze natural languages. This has led me to develop very simple best practices for analyzing logs.
## The Basics
- Logs are made up of output which are programmed by human beings. There are no real restraints on what is output, other than, some cultural rules on being professional. This makes the output from programs very much a natural language. This also makes the output of someone's program an approximation of the reality of what is happening inside a program. This is important to remember, logs are not perfect.
- When a systems administrator analyzes logs by changing them, they are creating an approximation of an approximation of reality inside a working program. This is not necessarily a bad thing, especially, when the programmer never gives you better than their approximation of reality anyway.
- In practice logs are made up of certainty and uncertainty. For example, I know what OpenSSH puts in the log during a login, because it is common. On the other hand, I do not know what a Compaq DL380 G3 will put in the log when it has a disk controller error. This is important to remember.
- The basic log analysis algorithm in Petit works to remove certainty, while leaving uncertainty. Stated another way, Petit quantitatively removes certainty, thereby leaving uncertainty, which by necessity requires qualitative analysis from a systems administrator.
- After the algorithm has been applied, the output must be read by a systems administrator to determine if it is normal or abnormal. Then abnormal entries can be acted on, hopefully before there is noticeable impact to your system.
### Design Principles
- Sane by default, works out of the box
- Designed to follow the Unix philosophy of small, fast and easy to use
- Intersect, not overlap, with other tools such as cat, tail, awk, sed, and grep
## History
Petit grew out of lt, a Perl script inspired by Marcus Ranum's [artificial ignorance](https://www.ranum.com/security/computer_security/papers/ai/), and became petit in August 2009. It was first shown at the Akron Linux Users Group that September, lived in Subversion at eyemg and then Mercurial on Google Code, and shipped in Fedora, EPEL, Debian and every Ubuntu release from 11.04 to 19.10. The distributions dropped it along with Python 2 in 2018–2020. It was ported to Python 3 in 2022, and in 2026 moved to [github.com/crunchtools/petit](https://github.com/crunchtools/petit) with native packages again.
This is the original 2009 overview video:
[embed]https://www.youtube.com/watch?v=5hI5sUPuzGc[/embed]
### Further Reading
- [Science in Systems Administration](https://crunchtools.com/science-in-systems-administration/) (2009)
- [Centralized Logging System, Analysis, and Troubleshooting](https://crunchtools.com/centralizing-log-files/) (2010)
- [Snort Alert Log: Simple Analysis and Daily Reporting with Arnold and Petit](https://crunchtools.com/log-analysis-simple-breakdown-of-snort-alert-log-with-arnold/) (2010)
- [Log Analysis with Python, PyOhio 2010](https://archive.org/details/pyvideo_514___pyohio-2010-log-analysis-with-python) (video)
- [Petit for Log Analysis](https://blog.jasonantman.com/2012/02/petit-for-log-analysis/) by Jason Antman (2012)
- [Petiti – An Open Source Log Analysis Tool for Linux SysAdmins](https://www.tecmint.com/petiti-log-analysis-tool-for-linux-sysadmins/) by Aaron Kili at Tecmint (2017)
- [Command Line Log Analysis Meets the Age of Agents](https://crunchtools.com/command-line-log-analysis-age-of-agents/), the 2026 relaunch
---
## Navigation
- [Home](https://crunchtools.com/)
- [Articles](https://crunchtools.com/category/articles/)
- [Events](https://crunchtools.com/category/events/)
- [News](https://crunchtools.com/category/news/)
- [Presentations](https://crunchtools.com/category/presentations/)
- [Software](https://crunchtools.com/software/)
- [Beaver Backup](https://crunchtools.com/software/beaver-backup/)
- [Check BGP Neighbors](https://crunchtools.com/software/check-bgp-neighbors-nagios/)
- [Chev](https://crunchtools.com/software/chev-check-vulnerabilities-script/)
- [Graph BGP Neighbors](https://crunchtools.com/software/grpah-bgp-neighbors/)
- [Graph MySQL Stats](https://crunchtools.com/software/graph-mysql-stats/)
- [Graph Sockets Pipes Files](https://crunchtools.com/software/graph-sockets-pipes-files/)
- [MCP Servers](https://crunchtools.com/software/mcp-servers/)
- [Petit](https://crunchtools.com/software/petit/)
- [Racecar](https://crunchtools.com/software/racecar/)
- [Shiva](https://crunchtools.com/software/shiva/)
- [About](https://crunchtools.com/about/)
- [Home](https://crunchtools.com)