git log fundamentals — reading history, decoding the default output

git log is the second command every engineer learns and the first command they underuse. The default output is verbose by historical accident: it was designed for the early Git mailing-list era, when contributors wanted to see author names, full dates, and the entire commit message in one scroll. In a CI pipeline, an incident post-mortem, or a pull-request review, that volume is noise. The production view of git log is a small set of flags that compress the output to the fields that actually matter: hash, branch, tag, and subject.

The default output, decoded

Running git log with no arguments prints the full history reachable from HEAD, newest commit first, in the project’s default format. Each entry contains:

• Commit hash — the SHA-256 (or SHA-1) identifier of the commit object. Long form is 64 hex characters (SHA-256) or 40 hex characters (SHA-1); short form is the unambiguous prefix that git log abbreviates to by default (7 characters, configurable with core.abbrev).
• Author line — Author: <name> <email>. Set per-commit by the author identity in the commit object, not by the current user.name and user.email config.
• Date line — Date: <human-readable timestamp>. The default format is the committer’s local timezone; the underlying value is stored as Unix epoch plus timezone offset.
• Subject line — the first paragraph of the commit message, printed preceded by four spaces and a newline.
• Body — the remainder of the commit message, separated from the subject by a blank line.

git log -n 1
# commit 8a3f9d2c1b4e7f0a9d6c5b2e8f1a4d7c0b3e6f9a (HEAD -> main, origin/main)
# Author: Ada Lovelace <ada@example.com>
# Date:   Mon Aug 18 14:23:09 2026 +0000
#
#     fix(terraform): pin router module to v3.2.7
#
#     The 3.2.6 release introduced a regression in the
#     us-east-1 default route that triggered a fan-out
#     of duplicate routing entries.

The default output is the most verbose form. Every other git log flag is a way of removing fields, changing separators, or restricting the set of commits shown.

The four flags that change the view

Four flags cover most of the surface area an infrastructure engineer needs. The first two change the format; the last two change the scope:

• --oneline — compress every commit to a single line of the form <short-hash> <subject>. The format is equivalent to --pretty=oneline --abbrev-commit. It is the default for git log in most CI tooling and the right starting point for any human-facing log.
• --graph — prepend a textual DAG visualisation to each line. The output uses *, |, /, and \ to draw the commit graph. Indentation increases with the depth of the commit in the merge tree.
• --decorate — append the ref names that point at each commit: HEAD, branches, remote-tracking branches, and tags. Use --decorate=full to prefix the ref namespace (refs/heads/main instead of main).
• --all — extend the history scope from HEAD to every ref in the repository. Without --all, git log shows only the commits reachable from HEAD; with --all, it shows every commit reachable from any local branch, remote-tracking branch, or tag.

git log --oneline --graph --decorate --all
# * 8a3f9d2 (HEAD -> main, origin/main) fix(terraform): pin router module to v3.2.7
# * 7d2e1f4 (origin/feature/edgemt) feat: add edge MTU to provider config
# |\
# | * 9c4a8b1 (tag: v3.2.6) chore: cut release v3.2.6
# * | 5b6f3a2 ci: add policy bundle to plan job
# |/
# * 1e0d9c4 (tag: v3.2.5) feat: support per-region IAM partition

The combination --oneline --graph --decorate --all is the production-friendly default for ad-hoc inspection. The first three flags control the format; the fourth controls scope. Together they fit in a muscle-memory alias and make the commit graph readable at a glance.

graph LR
    Default["git log"] -->|default| Out1["verbose: hash + author + date + body"]
    Default -->|--oneline| Out2["one line per commit"]
    Default -->|--graph| Out3["ASCII DAG prepended"]
    Default -->|--decorate| Out4["ref names appended"]
    Default -->|--all| Out5["every ref, not just HEAD"]
    Out1 --> Combined["--oneline --graph --decorate --all"]
    Out2 --> Combined
    Out3 --> Combined
    Out4 --> Combined
    Out5 --> Combined

History scope versus output formatting

A crucial distinction: some flags change what commits are shown, and some change how those commits are rendered. Conflating the two is a common source of confusion.

• Scope flags — --all, --branches, --tags, --remotes, --first-parent, --since=<date>, --until=<date>, --author=<pattern>, --grep=<pattern>. These change the set of commits that pass the filter.
• Formatting flags — --oneline, --pretty=<format>, --abbrev=<n>, --date=<format>, --decorate, --graph. These change the rendering of the commits that have already passed the filter.

The order does not matter: Git applies the scope filters first and the formatting flags last. git log --oneline --all and git log --all --oneline produce identical output.

Production discipline

1. Adopt a personal alias for --oneline --graph --decorate --all. The four flags together produce the most useful default for daily inspection. Memoise them as [alias] lg = log --oneline --graph --decorate --all in .gitconfig.
2. Use --first-parent for the deployment view. A linear history of merge commits is the history an auditor reads; the full DAG is the history an engineer investigates.
3. Distinguish scope flags from formatting flags. Scripts that copy a git log incantation often inherit the wrong intent if the original author was investigating versus auditing.
4. Never parse --pretty= output without quoting it. The subject line is free-form text and almost certainly contains spaces, quotes, and newlines. The next lesson covers the machine-readable formats that are safe to parse.

Cross-course references

• Linux for Production Sysadmins - Part XVIII (LogAggregation) covers the same argument: humans read the formatted output, scripts consume the structured contract.
• Ansible for Production Sysadmins - Part XXXVII (RepoArch) uses git log --oneline --first-parent as the audit view of an Ansible repository’s history.
• Terraform for Production Sysadmins - Part IX (State) treats git log --all --not HEAD as the recovery query for a branch that was force-deleted.

Quiz