Nginx access log
Combined and common log formats, including $request_time and
$upstream_response_time for measured server cost analysis.
Free · No signup · No storage
Analyze Server Logs Instantly
Upload a log file or zip archive. Get a security report, traffic breakdown, and actionable recommendations in seconds.
- Parser-only, nothing executed
- Nothing persists after analysis
- No account needed
- Open source logic
Upload your log file
Accepts .zip, .gz, .log, or .txt.
Multiple files? Zip them together.
- Max upload 40 MB
- Max per file 50 MB
- Max extracted 200 MB
Supports Every Major Log Format
Auto-detected on upload. No configuration required.
Apache access log
Combined Log Format (CLF) and Common Log Format from Apache httpd and compatible servers.
Syslog
RFC 3164 and RFC 5424 syslog lines from system daemons, auth services, cron, kernel, and application writers.
JSON Lines (JSONL)
One JSON object per line, as emitted by structured loggers in Python, Node.js, Go, and most modern application stacks.
PHP error log
PHP error_log output including Fatal, Warning, Notice, and
Parse errors. Stack traces are parsed and grouped, so recurring errors
collapse into counts rather than noise.
PHP-FPM slow log
Multi-line blocks emitted by request_slowlog_timeout.
Shows which scripts are slow, which pool they hit, and the full call
stack so you can pinpoint the bottleneck.
Plain text logs
Unknown or mixed formats are parsed on a best-effort basis, extracting timestamps, log levels, and message patterns.
Find What's Hiding in Your Logs
The analyzer runs a full suite of deterministic detectors, then synthesizes findings into a prioritized, plain-English report.
Security threats
Detects brute-force login attempts, path enumeration, SQL injection probes, suspicious user-agent patterns, and multi-vector attacker profiles across your logs.
Traffic analysis
Top URLs, status code breakdown, bandwidth by path, error spike detection, and timeline charts showing when traffic was heaviest.
Server resource cost
Which traffic classes consume the most of your server's time: hostile bots, unwanted crawlers, beneficial search engines, internal monitors, or legitimate visitors.
Bot detection
Identifies known crawlers, scanners, and bots by user agent and behavior. Separates search engines (beneficial) from scraper spam (unwanted) from active attackers (hostile).
Authentication events
Tracks failed and successful login events in auth logs and web access logs, surfacing credential-stuffing patterns and unusual login locations.
Application errors
Groups recurring error messages, tracks error rates over time, and highlights error spikes that correlate with traffic anomalies or deployment events.
Upload. Analyze. Act.
Three steps. No configuration.
Upload your logs
Drop a single log file, a .gz compressed log, or a
.zip archive containing multiple files. The format is
detected automatically.
Analysis runs instantly
The security kernel validates the archive, then all parsers and detectors run in sequence. Most archives finish in under five seconds.
Read your report
Review findings by severity, check the recommendations panel, and export the full report as Markdown to paste into a ticket or incident write-up.
Built for Security Teams
Your logs contain sensitive data. The analyzer is designed so that data never goes anywhere it shouldn't.
Parser-only
Log content is read as bytes and parsed deterministically. No code in an uploaded file is ever evaluated, interpreted, or executed.
Nothing persists
Uploaded files and extracted content live only for the duration of the request. The server never writes them to disk beyond the secure temp directory, which is wiped on completion.
No account
No login, no email, no tracking. Upload your file and get your report. The server does not know who you are and does not need to.
AI sees only summaries
If AI narrative is enabled, the model receives aggregate counts and sanitized message samples only. No raw log content, no file names, no IP addresses in bulk are forwarded to any AI service.
Archive hardening
Every upload passes a security kernel that blocks path traversal, zip bombs, symlinks, nested archives, and oversized entries before any parser sees a single byte.
Strict CSP
The report page runs under a strict Content Security Policy. Even if a log line contained an XSS payload, the browser would refuse to execute it.
Common Questions
What log formats does log-analyzer support?
The analyzer auto-detects and parses: Nginx access logs (combined and
common format, with optional $request_time), Apache httpd
access logs (Combined Log Format and CLF), RFC 3164 and RFC 5424 syslog,
JSON Lines (JSONL) structured logs, PHP error_log output
(Fatal, Warning, Notice, Parse errors with stack traces), PHP-FPM slow
logs (multi-line blocks with call stacks), and plain-text logs in a
best-effort mode. Format detection is automatic — no configuration required.
Can it analyze PHP errors and slow requests?
Yes. The PHP error log parser handles output from php.ini’s
error_log directive (and WordPress’s
wp-content/debug.log). It groups recurring Fatal, Warning,
and Notice entries by normalized message so you see counts rather than
thousands of identical lines.
The PHP-FPM slow log parser handles the multi-line blocks emitted when
request_slowlog_timeout fires. Each block becomes one event
with the slow script’s name, pool, PID, and full call stack,
making it easy to see which functions are responsible for the slowness.
How much of my log file gets analyzed?
By default, the most recent 14 days of it. A rotation set usually carries months of history, and findings averaged over months describe a server that no longer exists — a brute-force burst from six weeks ago outweighs the one that started yesterday, and “top offender” tables fill up with IPs that stopped long ago. Narrowing to recent history makes every number on the report something you can still act on.
The window is counted back from the newest entry in your log, not from today, so an archive you pulled off a server weeks ago still reports its own final days instead of coming back empty. Rotated files that end before the window are skipped entirely, and the report says exactly how much history was left out. Pick a different range — or “Everything in the file” — on the upload form.
What file types can I upload?
You can upload a plain log file (.log, .txt,
or any extension), a gzip-compressed log (.gz, as produced
by standard log rotation), or a .zip archive containing
multiple files. Tar archives (.tar, .tgz,
.tar.gz) are not supported; put your files in a zip instead.
Maximum upload size: 40 MB per archive. Maximum extracted content: 200 MB. Up to 1,000 files per archive.
Can I analyze multiple log files at once?
Yes. Zip your log files together and upload the archive. The analyzer processes every file in the zip, merges findings across files, and produces a single unified report. Cross-file analysis enables findings that require more than one log to detect, such as an attacker whose activity spans both an access log and an auth log.
What security threats can it detect?
The security detector suite covers:
- Brute-force and credential-stuffing attacks on login endpoints
- Path enumeration and directory traversal probes
- SQL injection and other parameter-injection attempts
- Suspicious and spoofed user-agent strings
- Error-rate anomalies that indicate active exploitation
- Multi-vector attacker profiles (one IP across multiple attack types)
- Authentication failures and unusual success patterns in auth logs
- Unwanted and hostile bot traffic consuming server resources
Every finding comes with a severity rating (Critical / High / Medium / Low / Info), a mitigation status, and a specific recommendation.
Is my log data private and secure?
Yes. Your logs are processed in memory for the duration of the HTTP request only. Nothing is written to a database. Nothing is logged on the server. The server does not identify you, store your IP, or retain any part of the uploaded file after the response is sent.
The application runs under a strict Content Security Policy and serves no third-party scripts or tracking pixels.
Do I need to create an account or sign up?
No account, no email, no registration. Upload a file and get a report. There is no authentication layer and no user tracking.
How long does analysis take?
Most archives complete in under five seconds. Large archives with many files or dense logs may take up to 60 seconds (the hard timeout). Analysis time scales roughly with the number of log lines, not the archive size.
Can I get the report as a file I can share?
Yes. Use the "Download as Markdown" button on the upload form. This
runs the same analysis and downloads the full report as a
.md file you can paste into a GitHub issue, Jira ticket,
incident post-mortem, or email thread.
What are the upload size limits?
| Max archive size | 40 MB |
|---|---|
| Max extracted content | 200 MB |
| Max files in archive | 1,000 |
| Max per-file size | 50 MB |
| Max analysis time | 60 s |
Ready to Analyze Your Logs?
No configuration. No account. Results in seconds.