No. logcrux makes no network calls at run time, ever. No telemetry, no update checks, no analytics, nothing. You can verify this yourself: it's open source.
No. logcrux runs entirely unprivileged. It only needs read access to
whatever log file you point it at. Note that sudo logcrux ...
itself needs logcrux on root's PATH, see
troubleshooting if a per-user
install (uv tool install, pipx) makes that
fail.
Linux (glibc ≥2.28) and macOS, on both x86_64 and arm64. Alpine and other musl-based distros aren't supported: the dependency behind local inference doesn't publish musl wheels. See install for the full platform list and the older/enterprise-Linux glibc floor.
Yes, fully. Every piece it needs (parsers, statistical detectors, and the local classification model) ships inside the package. Nothing is fetched at install time beyond the package itself, and nothing is fetched at run time at all.
An optional local SQLite database (see config)
for baseline event-rate tracking, stored at
~/.local/share/logcrux/state.db by default. It never leaves
your machine and is entirely optional (--no-baseline).
Only to fetch the package itself, same as any pip install
(if you're using uv without Python 3.11+ already on your
machine, it also fetches a matching Python interpreter). Once
installed, no further network access is needed.
logcrux degrades gracefully. The full statistical analysis still runs and is reported, with a note that classification wasn't available. It never blocks or errors out because of it.
Open an issue on GitHub. Adding a new log format is a small, well-defined PR if you want to send one yourself.