Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,9 @@ clean:
install: $(TARGET)
install -d $(DESTDIR)$(PREFIX)/bin
install -m 755 $(TARGET) $(DESTDIR)$(PREFIX)/bin/
install -d $(DESTDIR)$(PREFIX)/share/man/man1
install -m 644 doc/logreaper.1 $(DESTDIR)$(PREFIX)/share/man/man1/

uninstall:
rm -f $(DESTDIR)$(PREFIX)/bin/$(TARGET)
rm -f $(DESTDIR)$(PREFIX)/share/man/man1/logreaper.1
78 changes: 78 additions & 0 deletions doc/logreaper.1
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
.TH LOGREAPER 1 "March 2026" "LogReaper 1.0.0" "User Commands"
.SH NAME
logreaper \- high-speed log analysis and forensics tool
.SH SYNOPSIS
.B logreaper
.RI [ OPTIONS ] " <target>"
.SH DESCRIPTION
.B logreaper
scans log files (or directories of logs) for suspicious patterns such as
authentication abuse, web attacks, system anomalies, and malware/rootkit indicators.
It can also extract IOCs and export findings as JSON or CSV.
.SH OPTIONS
.TP
.BR \-a , " --auth"
Enable authentication log analysis (brute force, sudo, su).
.TP
.BR \-w , " --web"
Enable web log analysis (SQLi, XSS, LFI, RFI).
.TP
.BR \-s , " --system"
Enable system log analysis (kernel and service events).
.TP
.BR \-m , " --malware"
Enable malware/rootkit indicator analysis.
.TP
.BR \-A , " --all"
Enable all analysis modules (default).
.TP
.BR \-l , " --live"
Enable live monitoring mode.
.TP
.BR \-i , " --iocs"
Extract IOCs (IPs, domains, hashes).
.TP
.BR \-o , " --output" " <file>"
Write JSON report to <file>.
.TP
.BR \-c , " --csv" " <file>"
Write CSV report to <file>.
.TP
.BR \-v , " --verbose"
Verbose output (show matched lines).
.TP
.BR \-q , " --quiet"
Quiet mode (summary only).
.TP
.BR \-h , " --help"
Show help and exit.
.SH ARGUMENTS
.TP
.I <target>
Path to a log file or directory to scan.
.SH EXAMPLES
.TP
Analyze authentication logs:
.B logreaper -a /var/log/auth.log
.TP
Analyze web access logs and export JSON:
.B logreaper -w -o report.json /var/log/nginx/access.log
.TP
Run all modules and extract IOCs:
.B logreaper -A -i /var/log/
.TP
Live monitoring mode:
.B logreaper -l /var/log/syslog
.SH EXIT STATUS
Returns 0 on success, non-zero on error.
.SH FILES
.TP
.I /usr/local/bin/logreaper
Default binary installation path.
.TP
.I /usr/local/share/man/man1/logreaper.1
Default manual page installation path.
.SH AUTHOR
LogReaper contributors.
.SH LICENSE
MIT License.