logcrux / config

home install usage formats how it works config troubleshooting faq source

config

Plain YAML. logcrux checks these locations in order and uses the first one found:

1. --config PATH (explicit CLI flag)
2. ~/.config/logcrux/logcrux.yaml
3. /etc/logcrux/logcrux.yaml
4. built-in defaults if none of the above exist

Every field is validated (range-checked, unknown keys rejected). A typo'd key or an out-of-range value fails loudly at startup instead of silently falling back to a default.

full reference

analysis:
  window_size_minutes: 5        # time window for burst/rate analysis
  burst_multiplier: 3.0         # events threshold = baseline * multiplier
  auth_failure_threshold: 10    # count for auth_failure_cluster signal
  correlation_gap_seconds: 120  # max gap between correlated signals
  spike_factor: 3.0             # error rate spike = baseline * factor

inference:
  enabled: true                 # enable local classification
  threshold: 0.35               # min confidence to trust a category

state:
  db_path: ~/.local/share/logcrux/state.db
  baseline_alpha: 0.2           # exponential smoothing factor for baselines

security:
  allowed_log_paths: []         # empty = no restriction; set prefixes to sandbox
  max_file_size_mb: 2048        # file size limit

output:
  color: true
  show_remediation: true

notes

security.allowed_log_paths is useful if you're wrapping logcrux in a script or service and want to restrict it to a known set of log directories. Left empty (the default), any readable file is allowed.

inference.threshold filters near-random guesses. The classifier's output is spread across several categories, so a correct prediction typically lands well above chance while a genuinely uncertain one stays low. 0.35 is a reasonable default; raise it if you want fewer, higher-confidence named categories. (Deterministic signals like OOM or disk-full are unaffected by this threshold; they're always trusted directly.)