GitHub
ENIT
v0.7.1 · updated · GitHub

Quickstart

Install → first command → first report. Every block is copy-paste.

1 · Install

Pick your OS. No extra dependencies.

curl -sSfL https://raw.githubusercontent.com/lenny-ts/caddy-analyzer/main/install.sh | bash
# verify
caddy-analyze --version
# expected: caddy-analyze v0.6.1 (or newer)
iwr -useb https://raw.githubusercontent.com/lenny-ts/caddy-analyzer/main/install.ps1 | iex
# verify (new PowerShell)
caddy-analyze --version
go install github.com/lenny-ts/caddy-analyzer/cmd/caddy-analyze@latest
# verify (ensure $GOPATH/bin or $HOME/go/bin is in PATH)
caddy-analyze --version
docker pull ghcr.io/lenny-ts/caddy-analyzer:latest
# verify
docker run --rm ghcr.io/lenny-ts/caddy-analyzer --version
No implicit step
All commands use the public release URL. If curl fails, check Installation → troubleshooting.

2 · Get a log file

No Caddy server yet? Use the repo's fixtures — real Caddy JSON, RFC 5737 TEST-NET IPs, no real hosts.

git clone https://github.com/lenny-ts/caddy-analyzer.git && cd caddy-analyzer
ls testdata/sample.log testdata/large.log
# 68 lines curated (one per category) · 50K lines realistic (95% benign)

If you already have Caddy: /var/log/caddy/access.log or docker://caddy — jump to Log Sources.

3 · First command — report without detection

caddy-analyze testdata/sample.log

Expected: table with Period, RPS, status bars, Top IPs/Paths. Exit code 0. If you see permission denied, run with sudo (see Sources → permissions).

4 · First detection

caddy-analyze --detect testdata/sample.log

Expected: same report + Suspicious section grouped by IP:

Suspicious (26-category detect)
  198.51.100.7  4 malicious
    [sql_injection] GET /search?id=1' OR '1'='1
    [xss] GET /q=<script>alert(1)</script>
    ...

5 · First HTML report

caddy-analyze --detect -f html -o report.html testdata/sample.log
# open report.html in your browser (single file, no server)
xdg-open report.html  # Linux
open report.html      # macOS
start report.html     # Windows

Expected: dark standalone HTML with the same stats + suspicious details. Shareable — no external assets.

Next