Log Analyzer:-

This is a full stack web application that allows users to upload a log file and immediately analyze it for suspicious activity. The system detects failed requests, admin access attempts, and repeated IP addresses and provides a summary as well.

Features:-

Upload a log file from your computer using your preferred browser.

Detect failed requests such as 401 and 403 responses

Identify access to admin routes

Flag IP addresses that appear frequently

Handle invalid or malformed log entries without crashing

How it works:-

The user uploads a log file through the frontend.
The backend processes each line and converts it into structured data.
The application then applies simple rules to detect suspicious activity.
The results are returned and displayed on the frontend.

Tech stack used:-

Backend
Python
Flask
Flask CORS

Frontend
React
TypeScript
Vite

Project structure:-

tenex-log-analyzer/ backend/ app.py

frontend/ src/ package.json

README.md

How to run the project:-

In first terminal window,

Start the backend:

cd backend
source venv/bin/activate
pip install flask flask-cors
python app.py

Backend runs on http://localhost:5000

now, on second terminal window,

Start the frontend:

cd frontend
npm install
npm run dev

Frontend runs on http://localhost:5173 (this will the address the log analyzer will be located on)

Log format:-

Each line must follow this format:

timestamp, ip_address, method path, status_code

Example:

2026-03-17T10:00:00Z 192.168.1.10 GET /login 200 (splitting and labelling is done by the backend while processing)

Anomaly Detection Approach:-

This project uses a simple rule based approach to detect suspicious activity in log files.

Each log entry is parsed into structured data and evaluated against a set of predefined conditions:

• Failed requests are identified using status codes such as 401 and 403, which indicate unauthorized or forbidden access.

• Requests to sensitive routes are detected by checking for paths that contain /admin.

• Frequent IP activity is identified by counting how many times each IP address appears and flagging those that exceed a threshold.

This approach provides a lightweight and interpretable way to detect potential anomalies without requiring complex models.

Error handling:

The application handles empty uploads and malformed lines.
Invalid entries are skipped and reported without crashing the system.

Future Improvements:-

This project currently uses a rule based approach for detecting suspicious activity. In future iterations, this could be extended with more advanced techniques.

For example, machine learning models could be used to learn patterns of normal behavior and automatically detect anomalies. Additional features such as log visualization, user authentication, and deployment to a cloud platform could also be implemented to make the system more scalable and production ready.

Notes:

This project was built as part of a take home assignment to demonstrate full stack development, API design, and frontend integration. My focus was on delivering a well structured and functional prototype within the given time constraints. Additional features and deployment improvements can be explored in future iterations.