Tools / WebTrafficIQ

WebTrafficIQ — log analyzers

Five analyzers for the five logs that actually tell you what your server is doing. Each one parses the raw file, ranks what it found, and ends with a prioritised action plan you can copy out.

Everything runs in your browser. Logs are parsed with JavaScript on your own machine and never uploaded to QCRAMAI — no account, no size quota beyond what your browser can hold, and no copy of your log on our side. That matters most for the auth log, which contains usernames and source addresses, and for error logs, which routinely contain internal paths and occasionally credentials.

Each analyzer has the same two tabs: Info for what the log contains, and Predictions & Suggestions for what to do about it — a scorecard, ranked findings, anomaly detection and an exportable action plan.

Web traffic

Access log analyzer & advisorApache, Nginx and JSON access logs: traffic dashboard, security signal triage, capacity and cache forecasting, plus generated hardening config. Load balancer & CDN log analyzerAWS ALB, CloudFront and Cloudflare. Real p50/p95/p99 latency, cache hit ratio, and whether a 5xx came from the balancer or your app. iftop outgoing traffic analyzerReview peer IPs and transfer rates from iftop output, with heuristic checks for unexpectedly high outbound traffic. Runs locally.

Server health

Error log analyzerApache, Nginx and PHP error logs collapsed into recurring fault signatures, classified by root cause, with code hotspots. Slow query log analyzerMySQL and Postgres. Fingerprints queries, ranks by total time rather than worst case, and finds missing indexes from the rows-examined ratio.

Access and identity

SSH & auth log analyzerauth.log and secure. Finds sources that succeeded after repeated failures, root logins, sudo escalation and account changes.

Which log answers which question

"Is my site slow?" — the load balancer analyzer, because it is the only one of these logs that records duration. A plain access log cannot tell you how long anything took.

"Why is it slow?" — the slow query analyzer first, since the database is the usual answer, then the error log for upstream timeouts.

"Is someone attacking me?" — the access log analyzer for web-layer probing and scanners, the auth log analyzer for SSH. The auth log is the one that shows an actual break-in rather than an attempt.

"Is my server sending unusual traffic?" — the iftop analyzer for peer IPs and traffic rates. It can flag patterns to investigate, but cannot identify transferred data or prove theft.

"Something broke at 14:00" — start with the error log analyzer's anomaly detection to find the hour, then read the same window in the access or balancer log to see what the users saw.

What these tools do not do

They analyze a file you give them. They do not connect to your servers, collect logs continuously, alert you, or retain anything between page loads — reloading the page discards everything. For continuous monitoring you want a log platform; these are for the moment you have a log in front of you and need to know what is in it.

Every finding comes from threshold and pattern rules over a single sample. They rank and suggest; they do not prove cause, intent or compromise. Validate anything important against a second source before acting on it.