Desktop Log File Analyzer with Pattern Detection and Error Summarization

When a server misbehaves, the first artifact anyone reaches for is the log file — and it is usually tens of thousands of lines long. Developers scroll, grep, and eyeball timestamps, a slow manual process that routinely misses the actual story: the same failure repeating 200 times in an hour, a disk filling up in the background, or a brute-force attack hiding among routine warnings. Cloud log platforms solve this, but they cost money, need the logs shipped off-site, and are overkill for a student, a small team, or anyone debugging a single machine.

This project takes the opposite approach: a desktop utility that does the whole job locally, with no accounts, no servers and no data ever leaving the machine. LogScope parses common log formats, normalizes each line into a stable error signature, groups recurring patterns, detects bursts where one failure suddenly spikes, and writes a plain-language summary of what the file actually says — top error signatures, key findings, and recommended next steps — alongside an hourly timeline and a filterable viewer for the raw entries. It is deterministic pattern mining rather than black-box AI, which makes every result explainable in a viva: the student can point at the exact normalization rule behind each detected pattern.

1. The user drops a log file onto the app; the format detector sniffs the first few hundred lines and picks the matching parser (access-log, syslog, or JSON).
2. Each line is parsed into timestamp, severity, source and message, then stored in a local SQLite index for fast filtering.
3. The normalizer strips variable parts (IPs, timestamps, IDs, durations, quoted strings) from every error and warning line to produce a stable signature.
4. Identical signatures are grouped and counted; groups above a configurable occurrence threshold become detected patterns, ordered by impact.
5. A sliding-window scan flags bursts: any pattern with a sharp concentration of events inside one window is marked as a burst incident.
6. The summarizer ranks the top signatures, derives key findings (dominant incident, flapping dependency, resource exhaustion, attack-like repetition) and pairs each with a recommended next step.
7. The UI renders the timeline chart, pattern list, findings and the filterable raw-entry viewer; the whole report can be exported to PDF or HTML.

Tech stack:

• Electron + Node.js (cross-platform desktop shell)
• SQLite (local log index, no server needed)
• Vanilla JavaScript + SVG (timeline charts, no chart library weight)
• reportlab-free PDF export via Chromium print pipeline
• Jest (unit tests for parser and normalizer)

• [Multi-format log ingestion] Parses Apache/Nginx access logs, syslog-style lines and JSON application logs from a single drag-and-drop, with automatic format detection per file.
• [Signature-based pattern detection] Normalizes each line — IPs, timestamps, request IDs, durations and quoted strings replaced with placeholders — then groups identical failure modes and ranks them by occurrence count and severity.
• [Burst detection] Flags any signature that spikes inside a sliding time window, so a 200-occurrence pool-exhaustion incident reads as one incident, not 200 scattered lines.
• [Plain-language error summary] Generates top error signatures, key findings and recommended next steps from the detected patterns, written in readable sentences rather than raw statistics.
• [Timeline and severity views] Hourly error/warning volume chart plus per-pattern mini-distribution bars, making it obvious when an incident started and whether it is still growing.
• [Filterable log viewer] Severity chips and full-text search across message, source and IP, so any summarized claim can be verified against the raw entries in one click.
• [Exportable reports] One-click export of the summary, pattern table and timeline to PDF or HTML for attaching to incident notes or the project report.

Optional and future scope (clearly separated from the implemented build above)

• Optional: anomaly detection on event rate — an add-on module that flags hours whose error volume deviates sharply from the file's own baseline using z-score thresholds; not part of the core build.
• Future scope: ML-based log clustering — grouping free-text messages with TF-IDF and density clustering is documented as future scope, not implemented; the shipped build uses deterministic signature matching only.

• Complete Electron desktop application with installer builds for Windows, macOS and Linux
• Pattern-detection engine source (parser, normalizer, grouping, burst detection, summarizer)
• Realistic sample log dataset (multi-incident server log) used for the demo
• Exportable PDF/HTML report generator
• Project report PDF (background, log-analysis techniques, normalization design, methodology, results on the sample dataset)
• PPT presentation for final review
• Viva Q&A preparation document (log formats, regex parsing, signature normalization, burst detection, SQLite indexing)