Home

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• src/main.rs
• src/app.rs
• src/memory_db.rs
• src/file_settings.rs
• src/tabs/overview.rs
• src/tabs/security.rs
• src/tui_manager.rs

LogUtil is a high-performance, real-time Nginx log analysis tool developed in Rust. It provides developers and system administrators with an interactive Terminal User Interface (TUI) to monitor web traffic, detect security threats, and analyze server performance with minimal overhead. The system is designed to handle large log files (10,000+ entries) through efficient memory management and a specialized in-memory database.

Sources: README.md:1-12, src/main.rs:25-30

System Architecture

The application is structured into several core components that manage the lifecycle of log data from ingestion to visualization. The main entry point handles command-line arguments and determines whether to launch in direct analysis mode or interactive file selection mode.

Execution Flow

When the application starts, it follows a specific logic to initialize the environment and start the data processing pipeline.

The application uses a background task to monitor files for new lines while the main thread handles TUI rendering and user input.
Sources: src/main.rs:114-142, src/main.rs:280-310

Core Components

1. File Selection and Configuration

If no log file is specified via CLI, LogUtil enters an interactive mode. This module allows users to navigate the filesystem and configure analysis parameters before the TUI initializes.

Feature	Description	File Reference
Directory Navigation	Browse folders with intuitive icons (📁, 📄, ⬆️)	src/file_settings.rs
Pattern Configuration	Define custom regex and date formats for parsing	src/file_settings.rs
Feature Toggles	Enable/Disable specific tabs (Security, Performance, Bots)	src/file_settings.rs

Sources: src/file_settings.rs:115-180, README.md:52-70

2. In-Memory Database (MemoryDB)

The MemoryDB serves as the central data repository. It uses highly optimized data structures like DashMap for thread-safe access and implements manual indexing for IP addresses, URLs, and status codes to ensure sub-millisecond query times.

• Eviction Policy: To prevent memory exhaustion, the DB automatically removes old records when the count exceeds a defined threshold (default 10M records, with cleanup starting much earlier in practice for TUI responsiveness).
• Indexing: Critical indexes are maintained for IP addresses and URLs to support the "Top N" views.

Sources: src/memory_db.rs:34-60, src/memory_db.rs:98-115

3. TUI and Tab Management

The interface is managed by an App struct and a TabManager. The UI is divided into several specialized tabs, some of which are optional based on configuration.

The App struct coordinates the rendering of the header (containing summary stats and the progress bar) and the active tab content.
Sources: src/app.rs:43-70, src/tabs/mod.rs:1-15

Analysis Modules

LogUtil provides several specialized analysis modules:

Security & Threat Detection

The Security tab identifies suspicious patterns in real-time. It categorizes threats such as SQL Injection, XSS, Path Traversal, and Brute Force attempts.

• Logic: It scans log lines for signatures like union select, <script>, and ../.
• Visual Indicators: Uses icons (🔴🟡🟢) to signify threat severity.

Sources: src/tabs/security.rs:200-250, README.md:148-158

Visualization (Heatmap & Sparkline)

• Sparkline: Displays a real-time request rate visualization using 9-level bar symbols.
• Heatmap: Provides a color-coded hourly intensity grid, allowing users to identify peak traffic periods across days and weeks.

Sources: src/tabs/sparkline.rs:20-40, src/tabs/heatmap.rs:40-60

User Interaction

LogUtil supports a variety of keyboard shortcuts for navigation:

Key	Action
Tab / t	Switch to the next tab
Shift+Tab / T	Switch to the previous tab
Arrow Keys	Navigate within lists or switch between panels
Enter	Copy selected item (IP/URL) to clipboard
q / Ctrl+C	Exit the application

Sources: src/app.rs:105-150, README.md:83-100

Technical Specifications

Data Structures

The LogRecord is the primary data model used throughout the application.

pub struct LogRecord {
    pub id: u64,
    pub ip: String,
    pub url: String,
    pub timestamp: i64,
    pub status_code: Option<u16>,
    pub response_size: Option<u64>,
    pub response_time: Option<f32>,
    pub user_agent: Option<String>,
    pub log_line: String,
}

Sources: src/memory_db.rs:8-22

Performance Optimizations

1. Thread Safety: Uses Arc<RwLock<DBStats>> and DashMap for concurrent access between the TUI thread and the background parsing thread.
2. Zero-Copy Rendering: Tabs like DetailedTab filter data using the IP index to avoid scanning the entire database.
3. Lazy Summaries: The summary statistics in the header are cached and updated only once per second to reduce CPU load.

Sources: src/memory_db.rs:45-55, src/app.rs:245-260

LogUtil combines the safety and speed of Rust with an intuitive terminal interface, providing a robust solution for real-time web server log monitoring without the need for complex external stacks.