Your access loghas a watchdog.

1. 01

   Your web server sends its access log

   nginx sends each line over syslog (UDP); Apache pipes it. The default log format of both is understood as it is, so the web server config can stay the way it is.

2. 02

   httpdog matches it against your rules

   Conditions on any field of the log line, thresholds (20 times in 60 seconds), grouping (each IP counted on its own) and cooldowns (at most once every 10 minutes).

3. 03

   A match becomes one notification

   A signed JSON POST to a receiver you own, or a line in the system log. A slow or dead receiver never holds up log intake.

!httpdog is not a log store. To look back through old logs, pair it with a tool such as Loki or Graylog.

- id: sensitive-file-probe
  when:
    any:
      - { field: uri, op: suffix, value: /.env }
      - { field: uri, op: prefix, value: /.git/ }
      - { field: uri, op: regex, value: '\.(sql|bak|tar\.gz)$' }
  group_by: remote_addr
  cooldown: 10m
  notify: [console, ops]
  message: "{remote_addr} tried to access {uri} (status {status})"

ALERT [httpdog] sensitive-file-probe | 203.0.113.7 tried to access /.env (status 404) | remote_addr=203.0.113.7

full rule reference ->

• [ light ]

  One static binary

  About 4 MB on disk and about 5 MB of memory when idle. No database, no agent, no other service to run.

• [ zero config ]

  Reads the logs you already have

  Understands the default combined format of nginx and Apache as it is. Switch to JSON when you want to match on any field you like.

• [ reload ]

  Change rules without a restart

  systemctl reload applies them. A broken rule file keeps the old rules running, so monitoring never stops because of a typo.

• [ non-blocking ]

  Notifications never slow matching

  They are sent on their own thread and every queue is bounded. A dead webhook cannot back up log intake or eat memory.

• [ signed ]

  Webhooks you can verify

  Every request carries an HMAC-SHA256 signature and a timestamp. A webhook without a secret does not even load.

• [ strict ]

  Mistakes fail at load, not at 3 a.m.

  Unknown keys, bad regexes, wrong value types and missing secrets are all rejected when the file loads. --check validates without starting.

• [ hostile input ]

  Log content is treated as hostile

  It comes from whoever sends the request. The parsers and the rule engine are fuzzed, and a request cannot forge a line in your system log.

• [ systemd ]

  A well-behaved service

  Type=notify, a watchdog that restarts a hung process, no root, and an exit status that tells systemd when restarting will not help.

git clone https://github.com/guanting112/httpdog.git && cd httpdog
cargo build --release

# the example rules notify a webhook; a dummy URL and secret will do for now
export HTTPDOG_WEBHOOK_URL=http://127.0.0.1:9/dummy
export HTTPDOG_WEBHOOK_SECRET=dummy

./target/release/httpdog --stdin --config rules.example.yaml < sample.log

httpdog started: 4 rule(s), reading from stdin
ALERT [httpdog] sensitive-file-probe | 203.0.113.7 tried to access /.env (status 404) | remote_addr=203.0.113.7
ALERT [httpdog] slow-request | /report/monthly took 7.31s
ALERT [httpdog] sensitive-file-probe | 192.0.2.44 tried to access /backup/db.sql (status 404) | remote_addr=192.0.2.44
done: 6 lines, 0 unparseable, 3 alerts fired

full instructions in the README ->

X-Httpdog-Timestamp: 1794416274
X-Httpdog-Signature: sha256=1728aa567d7ef419cab2bf10fd5e1c764cdb608bd22d6f4d051b2043db19b8fe

{
  "source": "httpdog",
  "instance": "web-01",
  "version": 1,
  "kind": "rule",
  "rule": "login-bruteforce",
  "timestamp": 1794416274,
  "text": "[httpdog] login-bruteforce | 198.51.100.9 repeated login failures | 3x in 60s | remote_addr=198.51.100.9",
  "message": "198.51.100.9 repeated login failures",
  "group_by": "remote_addr",
  "group": "198.51.100.9",
  "hits": 3,
  "window_secs": 60,
  "dropped": null,
  "event": { "remote_addr": "198.51.100.9", "uri": "/login", "status": 401 }
}

webhook reference and a receiver example ->

• Tested in OrbStack machines, which share one kernel; SELinux was disabled on Fedora and Rocky Linux. Apache was only tested on Ubuntu and Debian.
• The log parsers and the rule engine are fuzzed on every push.

known limitations and what has not been verified ->