Esempi

Attività reali, da copiare e incollare. Sostituisci testdata/sample.log con la tua sorgente: Sorgenti log.

Debug dei 5xx dopo un deploy

# which paths 500 most?
caddy-analyze top path --5xx -t 20 testdata/sample.log
# only errors from last hour, host-filtered
caddy-analyze --5xx --from 1h --host api.example.com testdata/sample.log
# compare before/after
caddy-analyze diff /var/log/caddy/before.log /var/log/caddy/after.log -f csv -o diff.csv

Caccia a bot e scanner

caddy-analyze --bots-only -t 20 testdata/sample.log
caddy-analyze --no-bots --grep "wp-" testdata/sample.log
caddy-analyze top ua --bots-only testdata/sample.log
caddy-analyze top ip --no-bots --from 24h testdata/large.log

Geo — da dove arriva il traffico

caddy-analyze top country -t 15 testdata/sample.log
caddy-analyze --country IT --5xx testdata/sample.log
caddy-analyze --exclude-country CN,RU --from 7d /var/log/caddy/access.log -f html -o week.html

Richiede GeoIP mmdb (scaricato automaticamente in ~/.config/caddy-analyzer/ al primo utilizzo; consulta Configurazione → cache).

Analisi forense con --detect

caddy-analyze --detect testdata/sample.log
caddy-analyze --detect --country US -f json -o suspicious.json testdata/sample.log
caddy-analyze --detect -f html -o sec.html testdata/large.log && open sec.html
# live
caddy-analyze tail docker://caddy --detect

Ogni rilevamento ha tag MITRE; esporta Sigma: caddy-analyze export-sigma rules.yml (consulta Rilevamento).

Endpoint lenti

caddy-analyze --slow 500ms -t 20 testdata/sample.log
caddy-analyze --max-latency 100ms --min-size 500kb testdata/sample.log
caddy-analyze top path --slow 1s testdata/sample.log

Log operativi

caddy-analyze --ops-only --level error,warn testdata/sample.log
caddy-analyze --watch journalctl://caddy.service  # 8th tab = Operational

↑