Tools / Web server log analyzer & advisor
Web server log analyzer & advisor
Turn Apache or Nginx access logs into a traffic dashboard, then read prioritised capacity, caching, reliability and hardening suggestions drawn from the log itself. Paste log lines or open a file; analysis runs in your browser and the log is not uploaded.
Supports common/combined access logs and newline-delimited JSON with fields such as remote_addr, request, status, body_bytes_sent, http_referer and http_user_agent.
About this analyzer
This tool summarizes request volume, HTTP status codes, frequently requested paths, client IPs, referrers and user agents. Its heuristic checks flag sensitive-file and diagnostic endpoint requests, admin/login discovery, 10+ failed logins in 15 minutes, path enumeration, traversal and injection-like URL patterns, cloud metadata probes, uncommon methods and high per-IP request rates.
Supported formats and privacy
It accepts standard Apache/Nginx common and combined log lines, plus JSON Lines logs with recognizable access-log fields. Custom formats may need their fields mapped to one of these formats first.
Logs may contain personal data or credentials in URLs. Files and pasted text are processed locally in your browser and are not sent to QCRAMAI. Review and redact sensitive content before sharing exported data. Each analysis is limited to 200,000 non-empty lines and files to 25 MB.
Access logs do not always include request duration, request bodies, or complete proxy/client attribution. The dashboard can only analyze fields present in the log.
Log results
Load a supported log in the Log Input tab, then select Analyze logs. General log information and predictive security suggestions will appear here.
Requests over time
Traffic trend estimate & recommendations
Security signals & attack triage
Threat activity outlook
Signal summary
| Pattern | Matches | 2xx/3xx | 401/403/404 |
|---|
Source IP triage
| Client IP | Risk band / score | Flagged requests | Sensitive 2xx/3xx | Denied | First / last seen | Most common user agent | Signal types | Suggested action |
|---|
Heuristic thresholds: 60 requests/IP/minute, 10 failed admin/login requests/IP/15 minutes, or 30 distinct paths/IP/minute. Scores and matches rank patterns; they are not attack probabilities or proof of compromise. A 2xx/3xx response indicates HTTP success or redirection; confirm exposure in application and response details. Analysis uses logged request paths and methods, not request bodies.
Matching events (first 100)
| Signal | Time | Client IP | Status / count | Requested path |
|---|
Log health scorecard
Rule-based sub-scores derived from this log sample only. Every band is written out as text next to its number, so no judgement depends on colour alone. These rank what the log shows; they are not service guarantees, uptime measurements or attack probabilities.
Prioritised action plan
Every suggestion below is generated from a metric in this log and cites the figure that triggered it. Priority is written out (P1 / P2 / P3) rather than colour-coded. Review each against your own traffic baseline before acting.
| Priority | Area | Evidence in this log | Suggested action | Effort |
|---|
Anomaly & change detection
Hourly request volume, error rate and signal volume are scored with a median/MAD modified z-score (Iglewicz–Hoaglin, flagged at |z| > 3.5). A median-based score resists being dragged by the very spikes it is looking for. Flagged hours are hours worth reading, not confirmed incidents.
Capacity, peaks & bandwidth outlook
Cache & delivery opportunities
Reliability & error-budget outlook
Traffic composition & crawler budget
Suggested hardening configuration
Draft configuration generated from the signals above, with rate limits derived from this log's own per-IP request distribution rather than a generic default. Confirm client-IP attribution behind any CDN, proxy or shared NAT before applying a block, review every line, and test in staging first. Blocking a source does not remediate a file that was already served.
Suspected bots
User-agent and request-pattern hints only; user agents can be spoofed and legitimate tools may match.
| User agent | Requests | Source IPs | Signals |
|---|
IPs with suspicious signals
Prioritize review; validate proxy/CDN client-IP handling before applying blocks.
| IP | Signals | Requests | Suggested response |
|---|
Distinct sensitive paths
Unique sensitive or diagnostic paths requested, with response counts.
| Path | Requests | 2xx/3xx | Source IPs |
|---|
Distinct not-found paths
Unique paths returning 404; these may be broken links, ordinary misses, or automated probes.
| Path | 404 requests | Source IPs |
|---|
Status codes
| Code | Requests | Share |
|---|
Top URLs
| Path | Requests |
|---|
Top client IPs
| IP | Requests |
|---|
Top referrers
| Referrer | Requests |
|---|
Top user agents
| User agent | Requests |
|---|
Parse coverage
Unrecognized lines are skipped; the original log remains unchanged.
Requests
| Time | Client IP | Method | Status | Bytes | Request path | Referrer |
|---|