logcrux / usage
$ logcrux /var/log/syslogOr pipe a stream straight in:
$ tail -f /var/log/nginx/error.log | logcrux
$ journalctl -u nginx | logcrux--last DURATION | only analyze events from the trailing window, e.g. --last 1h, --last 30m, --last 2d |
|---|---|
--threshold FLOAT | minimum confidence to trust a classified category (default 0.35) |
--format NAME | force a parser instead of auto-detecting, e.g. --format nginx. Common aliases work: nginx, apache, k8s, dmesg, ssh, dnf, journal |
--no-baseline | skip comparison against historical baselines |
--json | machine-readable output instead of the terminal report |
--config PATH | use a specific config file (see config) |
--verbose | debug logging |
--version / -V | print the installed version |
--install-completion | install shell completion |
--show-completion | print the completion script |
--help | full flag reference from the CLI itself |
$ logcrux /var/log/syslog # analyze a file
$ logcrux /var/log/syslog --last 1h # only the last hour
$ logcrux /var/log/syslog --threshold 0.7 # raise confidence threshold
$ logcrux /var/log/syslog --format nginx # force a parser
$ logcrux /var/log/syslog --no-baseline # skip baseline comparison
$ logcrux /var/log/syslog --json # machine-readable output
$ logcrux /var/log/syslog --config my.yaml # custom config
$ logcrux /var/log/syslog --verbose # debug loggingScript-friendly by design:
0 | clean, nothing found |
|---|---|
3 | info or warning-level finding |
4 | critical finding |
Reading a file transparently decompresses it if it's gzip or bz2.
Detection is by magic number, not by trusting the
.gz/.bz2 extension, so a rotated
syslog.1.gz just works. A truncated or partially-corrupt
archive (say, a log rotated mid-write) is salvaged up to the point it
can still decompress, with a warning, rather than aborting outright.
If a line can't be parsed, it's counted and reported in the footer
("N line(s) unparsed"), never dropped without a trace. If the
auto-detected parser only covers a minority of the file, logcrux
re-parses with a generic fallback that never drops a non-blank line,
and keeps whichever result recovered more events. --format
disables this safety net if you want to force a specific parser
regardless.