About this project

A server log analysis tool that prioritizes privacy. It aggregates daily access logs (Apache/Nginx Combined format) already output by the web server and provides an admin interface running on PHP 8.1+ and SQLite. The design principle is "take only the data you need": IP addresses, raw User-Agent strings, full referrers, query strings, individual requests, copies of raw logs, visitor counts, session counts are never stored. Only aggregated values are kept: daily PV, 404, Bot, HTTP status codes, published pages, allowed referrer domain classifications, device/OS/browser classifications, etc. Main features: - Idempotent ingestion of daily gzipped logs in Apache/Nginx Combined format - Only pages listed in the public routes are counted as PV; unknown URLs are safely treated as 404 - Static assets are excluded from PV; known bots are tallied separately - Daily details retained for 90 days, monthly aggregates for 24 months (configurable) - Security measures: CSRF protection, secure sessions, login attempt limits, CSP, PDO prepared statements - Admin interface available in Japanese or English (selectable via locale setting) Setup: create a private directory outside DocumentRoot, place config.php and routes.json there, then start by running bin/daily-import.php via Cron. No event API is provided, and the tool never accepts arbitrary data from browsers. Licensed under Apache License 2.0.