install

$ uv tool install logcrux
$ logcrux --version

Or with pipx:

$ pipx install logcrux

Or plain pip, into whatever environment you're already in:

$ pip install logcrux

Requires Python ≥3.11 and glibc ≥2.28 (Alpine/musl is not supported, see below). That's otherwise the whole install: everything logcrux needs, including its local inference models, ships inside the package. Nothing is downloaded at run time and no network access is required to run it.

If your server's system Python is older (Amazon Linux 2023, RHEL 9, and Ubuntu 22.04 all default to 3.9 or 3.10), uv fetches a matching Python automatically, so uv tool install logcrux works without any manual interpreter setup. pipx instead uses whatever Python is already on your PATH, so install 3.11+ first (sudo dnf install python3.11 or sudo apt install python3.11) before using it.

supported platforms

Both x86_64 and arm64 are supported, on Linux and macOS:

system Python too old for pip (RHEL-family, openSUSE)

Rocky Linux, AlmaLinux, and Amazon Linux 2023 default to Python 3.9; openSUSE Leap defaults to 3.6. uv tool install logcrux sidesteps this entirely, since it supplies its own Python. For the pip path, install 3.11 explicitly first:

# Rocky / AlmaLinux / Amazon Linux 2023
sudo dnf install -y python3.11 python3.11-pip
python3.11 -m venv ~/.venvs/logcrux && ~/.venvs/logcrux/bin/pip install logcrux

# openSUSE Leap 15.6
sudo zypper install -y python311 python311-pip
python3.11 -m venv ~/.venvs/logcrux && ~/.venvs/logcrux/bin/pip install logcrux

older & enterprise linux

The blocker on older enterprise distros is glibc, not Python. onnxruntime only ships modern manylinux_2_27/manylinux_2_28 wheels, and below glibc 2.28 the uv installer silently falls back to a musl build, which then can't find a matching onnxruntime wheel either:

By distro family: RHEL/Rocky/AlmaLinux 8+, Ubuntu 20.04+, Debian 10+, Amazon Linux 2023, any current Fedora, and openSUSE Leap 15.3+/SLES 15 SP3+ all clear the glibc 2.28 floor. RHEL/CentOS 7, Amazon Linux 2, Ubuntu 18.04 and older, and SLES 12 do not.

Stuck below glibc 2.28? Run logcrux from outside the old host instead of on it:

ssh oldbox 'cat /var/log/secure' | logcrux
# or a sidecar container on a glibc 2.28+ base (e.g. debian:12-slim)
# with the old host's log directory mounted in

Alpine / musl

Not supported, at any Python version: onnxruntime does not publish musllinux wheels. Use a glibc base image (Debian, Ubuntu, Fedora, or a RHEL-family distro) instead, or analyze a container's logs from outside it:

docker logs <container> | logcrux

run without installing

$ uvx logcrux /var/log/syslog

Runs logcrux in a throwaway environment and cleans up after. Good for a one-off check on a box you don't want to install anything on.

shell completion

$ logcrux --install-completion    # installs for your current shell
$ logcrux --show-completion       # prints the completion script

Supports bash, zsh, fish, and PowerShell (via Typer).

upgrading

$ pip install --upgrade logcrux

uninstalling

$ pip uninstall logcrux

logcrux keeps a small local state database for baseline tracking at ~/.local/share/logcrux/state.db (see config). Remove it manually if you want a clean slate:

$ rm -rf ~/.local/share/logcrux

next

Now see usage for the full command reference.