LOGDETECTIVE(1)

📦
version 3.5.0 · 3 versions
, in fedora 44

💖 LOGDETECTIVE(1) 💖

okay bestie, gather round, because we're about to talk about logdetective — it lives in the User Commands section of the manual, and it is genuinely one of the most useful little gremlins you'll ever meet. no cap. 🕵️♀️✨

✨ NAME ✨

logdetective — analyze and summarize log files using LLM and Drain templates 🧚

🌸 SYNOPSIS 🌸

logdetective [OPTIONS] file

💅 DESCRIPTION 💅

so logdetective is a tool that analyzes log files with a LLM using the Drain log template miner. it's giving detective energy fr fr. 🕵️

it can consume logs from a local path or a URL, summarize them, and cluster them so inspecting them is way easier. main character tool behaviour honestly. 👑

🎀 POSITIONAL ARGUMENTS 🎀

  • file — the URL or path to the log file you want analyzed. that's the one, bestie, that's the snack. 🍓

✨ OPTIONS ✨

  • -h, --help — show the usage description and dip. bye! 👋
  • -M MODEL, --model MODEL — the path to the language model for analysis, if you've got it stored locally. you can also just specify the model by name based on the repo on Hugging Face (peep the Examples section, i gotchu). the repo id has to be in the form 'namespace/repo_name'. and since we're using LLama.cpp, we want this in the gguf format. bonus: if the model is already on your machine, it will skip the download entirely. slay. (optional, default: "fedora-copr/granite-3.2-8b-instruct-GGUF") 💾
  • -F FILENAME_SUFFIX, --filename-suffix FILENAME_SUFFIX — defines the suffix of the model file name to retrieve from Hugging Face. ⚠️ this option only applies when the model is specified by its Hugging Face repo name, and not by its path. (default Q4_K.gguf)
  • -n, --no-stream — disables streaming output of the analysis results. no drip-feed, just the whole thing at once. 🚫🌊
  • -C N_CLUSTERS, --n-clusters N_CLUSTERS — number of clusters to use with the Drain summarizer. (optional, default 8) 🗂️
  • -v, --verbose — enables verbose output during processing. and listen, you can go -vv or -vvv for higher levels of verbosity. go feral. 🗣️
  • -q, --quiet — suppresses non-essential output. shhh. 🤫
  • --prompts PROMPTS_FILE — (⚠️ Deprecated, replaced by --prompts-config and --prompt-templates) path to a prompt configuration file where you can customize (aka override the default) prompts sent to the LLM. for reference, look at https://github.com/fedora-copr/logdetective/blob/main/logdetective/prompts.yml.

prompts need to have a form compatible with Python format string syntax (see https://docs.python.org/3/library/string.html#format-string-syntax) with spaces, or replacement fields marked with curly braces, {}, left for insertion of snippets. the number of replacement fields in new prompts must be the same as in the original, though their position may be different. 📝

  • --temperature TEMPERATURE — temperature for inference. higher temperature leads to more creative and variable outputs, i.e. the model gets a little unhinged (affectionate). (default 0.8) 🌡️
  • --csgrep — use csgrep to process the log before analysis. when you're working with logs containing messages from GCC, it can be beneficial to employ an additional extractor based on the csgrep tool, to make sure the messages are kept intact. and since csgrep is not available as a Python package, it has to be installed separately — with a package manager, or from https://github.com/csutils/csdiff. 📦
  • --skip-snippets SNIPPETS_FILE — path to patterns for skipping snippets. you can specify regular expressions matching log chunks (the ones that maybe don't contribute to analyzing the problem), along with a simple description. patterns to be skipped must be defined in a yaml file as a dictionary, where the key is a description and the value is a regex. 🧹

examples:

contains_capital_a: "^.*A.*"

starts_with_numeric: "^[0-9].*"

child_exit_code_zero: "Child return code was: 0"
  • --prompts-config PROMPTS — path to a prompt configuration file where you can customize (override the default) prompts sent to the LLM and set optional configuration. reference at https://github.com/fedora-copr/logdetective/blob/main/logdetective/prompts.yml. ⚙️
  • --prompt-templates TEMPLATE_DIR — path to the prompt template dir. prompts must be valid Jinja templates, and system prompts must include the field system_time. 🧵

🌈 EXAMPLES 🌈

example usage:

$ logdetective https://example.com/logs.txt

or, if the log file is stored locally:

$ logdetective ./data/logs.txt

analyze a local log file using an LLM found locally:

$ logdetective -M /path/to/llm /var/log/syslog

with a specific model from HuggingFace (namespace/repo_name — and note that --filename-suffix is also needed here, don't forget it bestie):

$ logdetective https://example.com/logs.txt --model QuantFactory/Meta-Llama-3-8B-Instruct-GGUF --filename-suffix Q5_K_S.gguf

cluster logs from a URL (using Drain):

$ logdetective -C 10 https://example.com/logs.txt

🦋 SEE ALSO 🦋

💜 ADDITIONAL NOTES 💜

note that logdetective works as intended with instruction tuned text generation models in GGUF format. like, that's the vibe check it needs to pass. ✅

and that's the whole page, bestie!! 🫶 this was logdetective 1.0, dated 07/29/2026 — go analyze some logs and slay 💅✨🎀

📦 where this page comes from