LND Log Analysis — Find Errors and Warnings Fast

LND logs can be noisy. Here are the commands to quickly extract errors, warnings, and actionable events.

Basic log access

# Live log tail
sudo journalctl -u lnd -f

# Last 100 lines
sudo journalctl -u lnd -n 100

# Last hour
sudo journalctl -u lnd --since '1 hour ago'

Filter for errors and warnings

# Errors only
sudo journalctl -u lnd --since '24 hours ago' | grep -i 'ERR\|error\|WARN\|crit' | tail -30

# Payment-related issues
sudo journalctl -u lnd --since '24 hours ago' | grep -iE 'payment|htlc|invoice|route' | grep -iE 'fail|err|timeout' | tail -20

# Channel events
sudo journalctl -u lnd --since '24 hours ago' | grep -iE 'channel|close|force|breach' | tail -20

Common error patterns and meanings

# 'unable to find next hop' → routing failure, usually liquidity
# 'payment timed out' → HTLC stuck, needs manual resolution
# 'channel not found in graph' → stale channel data, restart may help
# 'failed to send to peer' → peer offline or TCP issue
# 'cannot allocate memory' → node needs more RAM or restart
# 'bbolt: database file corrupt' → serious, restore from backup immediately
# 'unable to connect to bitcoind' → backend connectivity issue

Set log level for more detail

# In lnd.conf
[Application Options]
debug-level=debug  # levels: trace, debug, info, warn, error, critical

# Or per-subsystem
debug-level=PEER=debug,LNWL=debug,CNCT=debug

# Restart LND after changing log level
sudo systemctl restart lnd

Export logs for sharing / analysis

# Save last 500 lines to file
sudo journalctl -u lnd -n 500 --no-pager > /tmp/lnd-logs.txt

# Anonymize pubkeys before sharing
sed 's/[0-9a-f]\{66\}/[PUBKEY]/g' /tmp/lnd-logs.txt > /tmp/lnd-logs-anon.txt

Need help reading LND logs? $9

I analyze your logs, identify the root cause, and fix the issue. USDT TRC-20.

→ Service page