_
| | ___   __ _  ___ _ __ _   ___  __
| |/ _ \ / _` |/ __| '__| | | \ \/ /
| | (_) | (_| | (__| |  | |_| |>  <
|_|\___/ \__, |\___|_|   \__,_/_/\_\
         |___/

an intelligent, fully local log analyzer. point it at a log, it tells you what's actually wrong.
Linux/Unix system logs, plus 209 web, database, container, cloud, and security formats.
no cloud. no telemetry. no account. pip install and go.

[ Apache-2.0 ]   [ Python ≥3.11 ]   [ runs unprivileged ]   [ works offline ]

home install usage formats how it works config troubleshooting faq source

what is this

logcrux reads a Linux/Unix log file (syslog, nginx, auth, kubernetes, whatever) and tells you if something is actually wrong. It looks for error-rate spikes, event bursts, auth-failure clusters, OOM kills, disk-full conditions, and service crashes, then hands you a plain-English summary instead of a wall of raw lines. Everything runs on your machine. No server component, no API key, no log data ever leaves the box it runs on.

Point it at a file, or pipe a stream into it:

$ logcrux /var/log/syslog
$ tail -f /var/log/nginx/error.log | logcrux

See install to get it running and usage for the full command reference.

example output

Illustrative run against a syslog with a memory-pressure incident in it:

$ logcrux /var/log/syslog

CRITICAL  Out-of-Memory Event Detected

Findings:
  - kernel invoked oom-killer 3 times in 90 seconds
  - process 'mysqld' (pid 8213) killed, oom_score 812
  - available memory dropped from 512MB to 12MB before the kill

Confidence: 0.91 (deterministic signal: oom_event)

Remediation:
  Check mysqld for a memory leak or runaway connection count.
  Consider adding swap or raising the container memory limit.

Parsed 48213 events in 0.41s.  Exit code: 4

No incident, no news: a clean run just prints a one-line CLEAN summary and exits 0. See usage for exit codes and how it works for the pipeline behind this.

why local

• logs are often the most sensitive data on a box; they should not have to leave it to be understood
• no API key, no account, no per-seat pricing, no rate limit
• works on an air-gapped machine exactly as well as an internet-connected one
• fully open source, Apache-2.0, no telemetry to audit because there isn't any
• runs unprivileged, reading a log file is all it needs

209 log formats are understood out of the box. See the full list. Anything unrecognized still gets parsed by a generic fallback that never silently drops a line.