Web Server Log Analyzer

Parse IIS W3C, Apache or Nginx access logs and get status, latency, path, client and user-agent summaries, with unusual patterns surfaced for triage rather than declared an attack.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop access logs

IIS (W3C), Apache or Nginx combined/common, or JSON access logs. Several files are combined. Analysed in your browser.

Or paste log lines

Trailing response-time field is in

Timestamps without an offset are in

Burst: requests per client per minute

Many 404s: at least

Traffic first, then the odd bits

The analyzer starts with the ordinary picture:

status classes;
the busiest paths and clients;
paths that error;
methods;
bytes served;
response time percentiles (p50, p95, p99), when the log records them;
a timeline.

User agents are sorted into browsers, search and AI crawlers, scripting tools such as curl and python-requests, and known scanners.

Surfaced for triage, not declared an attack

Request targets are URL-decoded, twice if they were double-encoded, and compared against short, readable patterns:

path traversal;
requests for files such as .env, .git/ or web.config;
SQL fragments;
script markup;
JNDI lookup strings;
shell syntax;
common admin endpoints.

Clients that trip several patterns rise to the top. A match means "look here". Most such requests are automated noise that got a 404, so the results say when matching requests actually returned 2xx.

Frequently asked questions

Does it block anything or contact the clients?

No. It is read-only analysis of a file, in your browser. It sends no traffic to your server or to any address in the log.

My log has X-Forwarded-For - which address is used?

The client address the log records first (c-ip, remote_addr or the first field). If your server logs the proxy's address, add the forwarded address to your log format for per-client results.

What time zone are the results in?

UTC. Apache and Nginx record an offset, which is honoured; W3C/IIS logs are UTC by specification; for JSON logs without an offset, choose the zone above.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.