No. logcrux makes no network calls at run time, ever. No telemetry, no update checks, no analytics, nothing. You can verify this yourself: it's open source.
No. logcrux runs entirely unprivileged. It only needs read access to
whatever log file you point it at. Note that sudo logcrux ...
itself needs logcrux on root's PATH, see
troubleshooting if a per-user
install (uv tool install, pipx) makes that
fail.
Linux (glibc ≥2.28) and macOS, on both x86_64 and arm64. On Alpine and other musl-based distros it runs without the local classification step (the dependency behind it publishes no musl builds): every detector works, incidents are named less precisely. See install for the full platform list and the older/enterprise-Linux glibc floor.
Yes, fully. Every piece it needs (parsers, statistical detectors, and the local classification model) ships inside the package. Nothing is fetched at install time beyond the package itself, and nothing is fetched at run time at all.
An optional local SQLite database (see config)
for baseline event-rate tracking, stored at
~/.local/share/logcrux/state.db by default. It never leaves
your machine and is entirely optional (--no-baseline).
Only to fetch the package itself, same as any pip install
(with uv tool install --python 3.12 and no Python 3.12 on
your machine, uv also fetches one). Once
installed, no further network access is needed.
logcrux degrades gracefully. Every detector still runs and is reported,
with a note on stderr that classification wasn't available; only the
naming of some incidents gets less precise. It never blocks or errors out
because of it. logcrux --doctor shows which mode you are in.
On about 1,900 labelled real incidents and healthy logs (Linux servers across eight distributions, containers, Kubernetes) it reports 99% of the faults and raises no false alarms on the healthy logs. Those incidents shaped the detectors, so read that as an upper bound. On software it had never seen before, it caught a little over half of the faults on first contact; the misses are almost always a single failure line in a wording it doesn't know yet. That is what the bug report below is for.
Apache-2.0. Use it, change it, ship it, including commercially. Keep the LICENSE and the NOTICE file with any copy or derivative work.
If logcrux said CLEAN when something was wrong, raised an alarm on a healthy log, or named the wrong incident, open a wrong verdict report with the redacted lines: each one becomes a test case. For anything else, open an issue on GitHub. Adding a new log format is a small, well-defined PR if you want to send one yourself.