_
| | ___   __ _  ___ _ __ _   ___  __
| |/ _ \ / _` |/ __| '__| | | \ \/ /
| | (_) | (_| | (__| |  | |_| |>  <
|_|\___/ \__, |\___|_|   \__,_/_/\_\
         |___/

an intelligent, fully local log analyzer. point it at a log, it tells you what's actually wrong.
works on any text log, and natively understands 200+ web, database, container, cloud, security, and Linux/Unix system-log formats.
no cloud. no telemetry. no account. uv tool install logcrux and go.

[ Apache-2.0 ]   [ Python ≥3.11 or uvx ]   [ runs unprivileged ]   [ works offline ]

what is this

logcrux reads a log file (nginx, postgres, kubernetes, syslog, auth, whatever) and tells you if something is actually wrong. It looks for error-rate spikes, event bursts, auth-failure clusters, OOM kills, disk-full conditions, and service crashes, then hands you a plain-English summary instead of a wall of raw lines. Everything runs on your machine. No server component, no API key, no log data ever leaves the box it runs on.

Point it at a file, or pipe a stream into it:

$ logcrux /var/log/syslog
$ tail -f /var/log/nginx/error.log | logcrux

See install to get it running and usage for the full command reference.

example output

An actual run against a syslog carrying an OOM-killer incident:

$ logcrux /var/log/syslog

╭────────────────────────   CRITICAL    Out of Memory ─────────────────────────╮
│   ● OOM killer fired  (42 events in 120s window)                             │
│   ● Error burst detected  (42 events in 120s window)                         │
│   ● Service crashed  (14 events in 117s window)                              │
│   Confidence: 97%                                                            │
│                                                                              │
│   Remediation: Check /proc/meminfo and `dmesg | grep -i oom`. Consider       │
│ adding swap or tuning vm.overcommit_memory=2 in /etc/sysctl.conf.            │
╰──────────────────────────────────────────────────────────────────────────────╯
Analyzed 42 events in 0.2s  │  3 incident(s)  │  logcrux v0.9.0

$ echo $?
4

No incident, no news: a clean run prints a brief CLEAN box and exits 0. See usage for exit codes and how it works for the pipeline behind this.

why local

• logs are often the most sensitive data on a box; they should not have to leave it to be understood
• no API key, no account, no per-seat pricing, no rate limit
• works on an air-gapped machine exactly as well as an internet-connected one
• fully open source, Apache-2.0, no telemetry to audit because there isn't any
• runs unprivileged, reading a log file is all it needs

See the full list of formats. Anything unrecognized still gets parsed by a generic fallback that never silently drops a line.