logcrux / faq
No. logcrux makes no network calls at run time, ever. No telemetry, no update checks, no analytics, nothing. You can verify this yourself: it's open source.
No. logcrux runs entirely unprivileged. It only needs read access to whatever log file you point it at.
Yes, fully. Every piece it needs (parsers, statistical detectors, and the local classification model) ships inside the pip package. Nothing is fetched at install time beyond the package itself, and nothing is fetched at run time at all.
Apache-2.0. Use it, embed it, modify it, fork it, ship it inside a commercial product. The license permits all of that, same as most serious open-source infrastructure.
An optional local SQLite database (see config)
for baseline event-rate tracking, stored at
~/.local/share/logcrux/state.db by default. It never leaves
your machine and is entirely optional (--no-baseline).
Only to fetch the package itself, same as any pip install.
Once installed, no further network access is needed.
logcrux degrades gracefully. The full statistical analysis still runs and is reported, with a note that classification wasn't available. It never blocks or errors out because of it.
Open an issue on GitHub. Adding a new log format is a small, well-defined PR if you want to send one yourself.