Open one supported static HAProxy access-log file in your browser and review HTTP proxy requests, status codes, source IPs, response bytes, routes, and total timing when the supported field is present. The file is not uploaded to our servers; parsed records may be stored in this browser's IndexedDB.
Drop or choose a static HAProxy access log. The file is read locally in this browser.
Drop or choose a static HAProxy access log. The file is read locally in this browser.
Nginx, Apache, Caddy, or HAProxy access log
HAProxy Access Log Analyzer is for examining a saved access-log snapshot after an incident, deployment, or traffic change. It is not live monitoring: HTTP errors mean parsed records with status 400 or higher, and risk indicators are heuristic review prompts rather than attack findings.
The parser reads supported fields from one static HAProxy access log at a time and builds a local snapshot of HTTP proxy requests, status codes, source IPs, response bytes, routes, and total timing when the supported field is present. It does not parse the server's error-log format or follow a live stream; selecting another file replaces the current local dataset.
Use the timeline, filters, summaries, and matching raw lines to verify what the file contains. Signals based on sensitive paths, user-agent signatures, HTTP-error ratios, or request volume only flag records for review; they do not establish that a request or client is malicious.
No. The selected file is read in your browser and is not uploaded to our servers. Parsed records may remain in this browser's IndexedDB until you clear or replace the dataset, or remove the site's stored data.
It accepts one supported static HAProxy access-log file at a time. It does not parse HAProxy server error logs, monitor a live stream, or keep a multi-file archive.
Any parsed access record with an HTTP status of 400 or higher appears as an HTTP error, including 4xx and 5xx responses. That label does not by itself imply an attack.
No. It highlights explainable heuristics such as sensitive-path matches, selected suspicious user-agent signatures, high HTTP-error ratios, or high request volume. Review the matching raw records and surrounding context before deciding what happened.
Metrics depend on fields successfully parsed from the selected format. Request counts, unique client IPs, status codes, paths, and response bytes may be available; referrer, user-agent, and timing views require corresponding fields, and timing requires a compatible duration value.