Explain a log line, field by field
Paste one log record — an access-log line, a syslog or auth.log line, a Windows event in XML, a CloudTrail, Entra ID or CrowdStrike event in JSON, a CEF, LEEF or PAN-OS line — and see what each field means and where that meaning comes from. Times, error codes, addresses, ports and encoded commands are decoded where the value says what it is. Nothing you paste leaves your browser.
Where the explanations come from
Every explanation names its source, and a field no source covers is listed with its value only — never with a guess. The sources are:
- The field references on this site, for 15 formats: AWS CloudTrail Log Format, AWS VPC Flow Log Format, AWS WAF Log Format, CEF (Common Event Format) Log Fields, CrowdStrike Falcon Event Log Fields, Duo Security Log Format, Entra ID (Azure AD) Sign-In Log Fields, Kubernetes Audit Log Fields, LEEF Log Format (IBM QRadar), Okta System Log Format, Palo Alto PAN-OS Log Fields, Suricata EVE JSON Log Fields, Sysmon Log Fields, Windows Security EVTX Log Fields, Zeek Log Format (http.log).
- The event references — 10 Windows Security events, 6 AWS CloudTrail events and 9 CrowdStrike Falcon events — when the record is one of them.
- The format’s own definition, for layouts that are a standard: nginx’s combined log format, the syslog RFCs (5424 and 3164), Microsoft’s event schema and Palo Alto’s syslog field descriptions.
- Microsoft’s code tables for AADSTS, NTSTATUS and Kerberos codes (the same tables as the error code lookup), and CrowdStrike’s value tables for numeric Falcon fields.
The format itself is recognised by the same code as the free log analyzer, which reads 53 formats,
and the record is read the way the analyzer reads it: JSON as dotted paths (status.errorCode), Windows events by their System
and EventData names, and text lines by position. When you paste more than one record, the first is explained and the analyzer’s checks run on all of them.
What gets decoded
| Value | What you see |
|---|---|
| Times | Unix seconds and milliseconds, Windows FILETIME and ISO times become a UTC time, with the reading used; a time without a zone says so. |
| IP addresses | Private, loopback, documentation and other reserved ranges are named; a public address links to the blocklist checker. |
| Microsoft error codes | Entra ID (AADSTS), NTSTATUS (Status and Sub Status of 4625 and 4776, in hex or decimal) and Kerberos codes get Microsoft’s own description and a link to the code’s page. |
| Windows logon types | The number in LogonType, from Microsoft’s logon type table. |
| CrowdStrike values | Numeric Falcon fields such as LogonType, IntegrityLevel and SubStatus, from CrowdStrike’s own value tables. |
| Encoded PowerShell | A powershell -enc payload is decoded and what it does is flagged, with a link to decode nested layers. |
| HTTP status, ports, protocols | Reason phrases from RFC 9110, service names for well-known ports and IANA protocol numbers. |
| Syslog priority | The <PRI> number split into facility and severity, per RFC 5424. |
| Scanners and probes | sshd messages, scanner paths and scanner user agents that have a page here link to it, with what our own server sees of them. |
Reading a record during an incident
Most fields fall into four questions: who (the user, account or principal, and the address it came from), what (the request, event type, command or API call), when (and in which time zone — a syslog time has no year and no zone, a Windows TimeCreated is always UTC), and with what result (a status, an error code, an action such as allow or reset-both). The explanations point out fields the client controls — a User-Agent, a Referer, the request target — because those prove nothing about who sent them, and decodes the result codes, because a failure’s code is usually what separates a typo from an attack: a wrong password for an account that exists reads differently from a user name that does not.
Questions
- Is the log line I paste uploaded anywhere?
- No. The page downloads its field references once and does the reading in your browser, so the record — with whatever user names, addresses or tokens it holds — never leaves the tab.
- Which log formats does it understand?
- It recognises the 53 formats the free log analyzer reads, using the same code. Every field of a record is listed and its value decoded; a field gets a written explanation when a reference page here documents it or when its format has a published standard layout, such as nginx’s combined format, syslog, Windows events or PAN-OS.
- Why does a field have no explanation?
- The explainer only states what a source it can name says — a reference page, a vendor’s field description or a standard. A vendor-specific field nobody here has documented yet is shown with its value and any decoding, rather than with a guess about what it means.
- Can it read a whole file?
- It explains the first record and counts the rest. To check a whole file for password spraying, brute force that succeeded, scans or privilege changes, use the log analyzer, which runs the same detections LogTriage runs on uploads.
One record explained; now the whole file
The free browser analyzer reads the whole log and flags password spraying, brute force that succeeded, scans, privilege changes and log tampering, with the evidence rows for each. Nothing is uploaded.