caddy-analyzer: The security-first log analyzer Caddy has been missing

Description and use

caddy-analyzer automatically parses Caddy v2 JSON logs, detects 26 attack categories, blocks IPs in real time, and offers dashboards and reports.

Problem

Standard log analysis tools cannot parse Caddy v2’s nested JSON logs and lack security threat detection, forcing users to write brittle custom scripts.

Outcome

caddy-analyzer enables automated parsing of Caddy JSON logs, detects 26 attack categories, blocks malicious IPs in real time, and provides dashboards and reports, eliminating custom scripting and improving security posture.

Workflow

• Install caddy-analyzer via curl script or download binary
• Configure log path with caddy-analyze config /var/log/caddy/access.log
• Run full security scan with caddy-analyze --detect
• Stream live logs with detection using caddy-analyze tail --detect docker://my-caddy
• Launch interactive dashboard with caddy-analyze --watch
• Use caddy-analyze guard docker://my-caddy for automatic iptables blocking

Evidence

caddy-analyzer is a CLI tool (written in Go) that natively parses Caddy v2 structured JSON logs and layers a full security detection engine on top.

Source

The guard subcommand monitors your log stream and auto-blocks malicious IPs via iptables.

Source

Performance: ~7,000 lines/sec with detection, ~70,000 lines/sec parse‑only.

Source