how it works

  log file / stdin
        |
        v
  [ parse ]        auto-detect format, or --format to force it
        |
        v
  [ analyze ]      error-rate spikes, bursts, auth clusters,
        |          OOM, disk-full, service crashes, proxy anomalies
        v
  [ classify ]     names the incident category, groups related events
        |
        v
  [ summarize ]    one incident, a plain-English title,
        |          findings, and remediation
        v
  terminal output / --json

parse

Format is auto-detected from the path and a content sample. If detection only covers a minority of the file, logcrux falls back to a generic parser that never drops a non-blank line, and keeps whichever result recovered more events. See formats.

analyze

A set of statistical detectors look for concentrated, meaningful anomalies, not just noisy volume. A burst of benign INFO lines isn't an incident; a dense cluster of warnings-or-worse is. Detectors cover error-rate spikes against a historical baseline, event bursts, auth- failure clusters, OOM kills, disk-full conditions, service crashes, and proxy/firewall anomalies (denial clusters, tunnel anomalies). Overlapping signals for the same window are deduplicated into one finding.

classify

Deterministic, high-precision signals (a literal OOM kill, a disk-full message, an auth-failure cluster) are trusted directly as the root cause. For more generic signals, a small local classification model names the likely incident category and groups related events together so you see one incident instead of a hundred near-duplicate lines. This step runs entirely on-device (no network call, no external API) and is optional: if it's unavailable for any reason, logcrux still reports everything the statistical analysis found and says so plainly, rather than pretending nothing happened.

summarize

Signals and classification are combined into one incident: a title, supporting findings with representative log lines, a confidence score, and (where applicable) a remediation suggestion. Output is either a Rich-formatted terminal report or --json for scripting.

state (optional)

A local SQLite database tracks historical event rates so later runs can compare against a baseline instead of guessing at "normal." It's purely local, gracefully skipped if unavailable, and disabled per-run with --no-baseline. See config for the path and tuning knobs.