Log Commander

WARN sources

Not every log is a file.

Receive syslog, follow a file on a server, watch Windows events, tail a database table. Each one arrives as lines in a tab, with everything a file has: filters, search, freeze, columns, timeline, dashboard, export, and a merge with a local file by time.

INFO one read path for everything

A spool, then the same tail.

A source writes its lines into a spool file in the app’s cache folder. The tab tails that file like any log. Nothing in the index, the filters or the dashboard knows the difference.

bounded

It cannot fill your disk

A spool is at most 2 GB per source by default (64 MB to 8 GB), split into files of 256 MB. Beyond it the oldest file goes.

escaped

Foreign text stays text

Control characters, bidi marks and line separators are escaped before a line reaches the spool. One message is one unambiguous line.

no secrets on disk

Passwords stay out

Sources are remembered and saved in workspaces without secrets. A workspace never connects by itself.

WARN ⇣ Syslog :5514

Syslog receiver

UDP and TCP, RFC 3164 and 5424.

Open a listener and watch what arrives. Each message becomes one line: time of receipt, sender, the message as received. The priority gives the level.

TCP speaks RFC 6587 with octet counting and newline framing. The status bar shows the state and counters: received, dropped, cut, refused.

Measured: 100,000 messages per second over UDP without loss, about 0.1 s from receipt to the index.

Cmd/Ctrl+Shift+L
⇣ Syslog :5514
Received syslog messages as a table with sender and priority
The dialog to open a syslog source
Only this computer by default. Listening wider needs an explicit tick.

INFO ⇅ host:/var/log/app.log

Remote files over SSH/SFTP

Follow a log on a Linux server, live.

Pick a host (the ones in ~/.ssh/config are offered), log in with the SSH agent, a key file or a password, and browse to the file. Start with the last 50 MB or the whole file.

Rotation and truncation on the server are recognised. A broken connection is tried again after 1, 2, 4 … 60 s and continues where it stopped. Several files of one server share one connection.

Cmd/Ctrl+Shift+H
⇅ web-01:/var/log/app.log
A remote file followed over SFTP
The remote dialog with folder browser and host key question
An unknown host key is shown with its SHA256 fingerprint. A changed one ends the connection.

FATAL Application · System · Security

Windows event logs

Live, instead of the slow Event Viewer.

Any channel of this computer or of another one. First the events of a period (24 hours by default), then a subscription for new ones. After a broken connection it goes on at the bookmark, without gap or doubles.

Each event becomes one JSON line with time, level, provider, event ID and message, so everything works as for any JSON log. Critical is FATAL, audit failure is ERROR. Right click “same event ID” filters on the ID.

Only on Windows. On macOS and Linux this source does not appear.

System
Windows events as a table (mock, taken on macOS)
The Windows events dialog (mock, taken on macOS)
The app never asks for elevation. For “Security” it tells you which group you need.

DEBUG db:public.app_log

Logs from databases

A SELECT that keeps running.

PostgreSQL, MySQL and MariaDB, SQL Server or a SQLite file. “Choose table” writes the query, “Preview” shows the first 20 rows as they will arrive.

Rows come in order of a key column, an id or a time: first the last 1000, then every 2 seconds the new ones. Rows with the same key are neither lost nor doubled.

Each row becomes one JSON line. Times in ISO 8601, numbers as numbers.

Cmd/Ctrl+Shift+L · kind “Database”
db:public.app_log
A database table as a live log (mock data)
The database dialog with table and preview (mock data)
The query is checked: one SELECT, nothing that writes or acts on the server.

ERROR refused: host key changed

Strict where it touches a network.

A listener takes data from outside. SSH and databases touch credentials and other people’s servers. This is what the app does about it.

Receiving syslog
  • Only this computer by default: 127.0.0.1, port 5514. Listening on all interfaces needs an explicit tick, and the dialog warns that other computers can then reach the port.
  • Sender filter: addresses and networks such as 10.0.0.0/8. It is no authentication for UDP, sender addresses can be forged.
  • Bounded: 64 KB per message, 64 TCP connections (8 per sender), 8 sources at a time, 32 MB waiting for the disk. When the disk cannot keep up, messages are dropped and counted instead of filling memory.
  • Nothing is sent back: no replies, no amplification, no host name lookups. No TLS.
  • Closing the tab stops the listener and deletes the spool, unless you ticked to keep it.
SSH logins and host keys
  • Host keys are checked against ~/.ssh/known_hosts (only read, never written) and the app’s own list. An unknown key is shown with type and SHA256 fingerprint. A changed or revoked key ends the connection. There is no “connect anyway”.
  • Logins: SSH agent first, then a key file or a password. Secrets are kept in memory only while the connection lives, and in the system keychain only when you tick it and the login worked. A refused login is not retried, so no account gets locked.
  • Only SFTP: no shell, no commands, no port or agent forwarding. Every channel a server tries to open is refused.
  • ~/.ssh/config: Host, HostName, User, Port, IdentityFile and Include are read. ProxyCommand and its relatives are never run.
  • Not supported: ProxyJump, host certificates, Kerberos.
Reading databases

Use a read-only database account. Give Log Commander its own user with SELECT on the log table and nothing else. The checks below are a second line, not a replacement: a read-only transaction does not stop SELECT … INTO OUTFILE for an account that has that right.

  • One SELECT: words that write or act on the server, functions with side effects and a second statement are refused, also when hidden behind comments, quotes or dialect quirks.
  • Read-only on the server: read-only sessions and transactions for PostgreSQL and MySQL, a transaction that is always rolled back for SQL Server, SQLite opened read-only with an authorizer.
  • Limits: 30 s per query, 10,000 rows or 32 MB per batch, 200 columns.
  • TLS is on and the certificate checked by default. A stored password is bound to the TLS mode: it is never sent over a weaker connection.
  • SQL Server with SQL login only. No Oracle, no ODBC.
Windows event logs
  • “Security” needs administrator rights or the group Event Log Readers. The app never asks for elevation and says so instead.
  • Another computer is read with your Windows identity or with user and password. The password is used for this connect only, or kept in the Windows Credential Manager when ticked.
  • Remote reading needs the firewall rule “Remote Event Log Management” on that computer.
Workspaces from someone else

A .lcw file is checked field by field and never runs anything. Remote files, databases and listeners beyond this computer are listed unticked in the confirmation, a database with its query. Passwords and host keys are always asked for in the dialog.

The full text in the README

$ echo '<11>test' | nc -u -w0 127.0.0.1 5514

Send it a line.

Download 1.0 from GitHub Next: AI control