bokamba / loganvil / Apache access logs

$ loganvil generate apache

Generate synthetic Apache access logs

Generate realistic synthetic Apache access logs (combined format, with an auth user) for pipeline testing, SIEM demos, and detection tuning — deterministic and 100% client-side. Each line carries the real Apache combined shape — client IP, auth user, CLF timestamp, request line, status, bytes, referer and user agent — so it round-trips straight back through a parser. No real users, IPs, or secrets.

Open the LogAnvil generator →

This sample, generated

The block below is 15 lines of Apache access logs, produced by the real generator at seed 42 — deterministic, so this exact output regenerates anywhere. The live tool re-runs the identical engine on whatever source, seed, line count and anomalies you pick.

15lines
4.3stime span
0anomaly lines
42seed

no anomalies injected — raise a slider to seed detectable patterns

Generated Apache access logs

Real on-the-wire Apache access logs — no real users, IPs, or secrets. Copy it into a fixture, feed it to a parser, or seed a SIEM demo.

172.16.31.77 - admin [13/Sep/2020:12:26:40 +0000] "GET /login HTTP/1.1" 200 39984 "https://t.co/abcdEFG" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"
192.0.2.146 - carol [13/Sep/2020:12:26:40 +0000] "GET /static/style.css HTTP/1.1" 200 30130 "https://news.ycombinator.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
10.10.10.10 - alice [13/Sep/2020:12:26:40 +0000] "GET /images/logo.png HTTP/1.1" 200 11072 "https://news.ycombinator.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"
172.16.31.77 - alice [13/Sep/2020:12:26:41 +0000] "GET /api/v1/products/24518 HTTP/1.1" 200 19432 "https://news.ycombinator.com/" "Googlebot/2.1 (+http://www.google.com/bot.html)"
10.10.10.10 - dave [13/Sep/2020:12:26:41 +0000] "GET /static/style.css HTTP/1.1" 200 59382 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
1.1.1.1 - alice [13/Sep/2020:12:26:41 +0000] "GET /api/v1/orders HTTP/1.0" 200 59832 "https://www.google.com/" "python-requests/2.31.0"
192.168.1.133 - bob [13/Sep/2020:12:26:41 +0000] "OPTIONS /api/v1/products HTTP/1.1" 200 21565 "https://example.com/login" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0"
172.16.31.77 - www-data [13/Sep/2020:12:26:42 +0000] "GET /search HTTP/1.1" 200 18939 "-" "python-requests/2.31.0"
192.0.2.1 - svc-backup [13/Sep/2020:12:26:42 +0000] "POST /index.html HTTP/1.0" 200 44780 "https://www.google.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"
172.16.4.9 - carol [13/Sep/2020:12:26:42 +0000] "GET /metrics HTTP/1.1" 200 25148 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)"
192.168.1.50 - jenkins [13/Sep/2020:12:26:43 +0000] "POST /metrics HTTP/1.1" 200 31312 "https://www.google.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
104.16.132.229 - erin [13/Sep/2020:12:26:43 +0000] "GET /logout HTTP/1.1" 403 10487 "https://www.google.com/" "curl/8.4.0"
172.16.31.77 - frank [13/Sep/2020:12:26:43 +0000] "GET /api/v1/users/89564 HTTP/1.1" 200 39096 "https://example.com/" "curl/8.4.0"
10.10.10.10 - erin [13/Sep/2020:12:26:44 +0000] "GET /logout HTTP/1.1" 200 20110 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0"
10.1.10.200 - svc-backup [13/Sep/2020:12:26:44 +0000] "GET /static/style.css HTTP/2.0" 200 9865 "https://t.co/abcdEFG" "curl/8.4.0"

With an anomaly injected: HTTP 5xx spike

The same source, regenerated with a HTTP 5xx spike injected at 30% intensity. 1 line is tagged and highlighted below — A run of 5xx responses from one client/path — an outage or an app under attack a SOC should page on. It is a documented, detectable pattern your SIEM rules should fire on — build the test data, then prove your detection works.

172.16.31.77 - admin [13/Sep/2020:12:26:40 +0000] "GET /login HTTP/1.1" 200 39984 "https://t.co/abcdEFG" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"
192.0.2.146 - carol [13/Sep/2020:12:26:40 +0000] "GET /static/style.css HTTP/1.1" 200 30130 "https://news.ycombinator.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
10.10.10.10 - alice [13/Sep/2020:12:26:40 +0000] "GET /images/logo.png HTTP/1.1" 200 11072 "https://news.ycombinator.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"
172.16.31.77 - alice [13/Sep/2020:12:26:41 +0000] "GET /api/v1/products/24518 HTTP/1.1" 200 19432 "https://news.ycombinator.com/" "Googlebot/2.1 (+http://www.google.com/bot.html)"
10.10.10.10 - dave [13/Sep/2020:12:26:41 +0000] "GET /static/style.css HTTP/1.1" 200 59382 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
1.1.1.1 - alice [13/Sep/2020:12:26:41 +0000] "GET /api/v1/orders HTTP/1.0" 200 59832 "https://www.google.com/" "python-requests/2.31.0"
192.168.1.133 - bob [13/Sep/2020:12:26:41 +0000] "OPTIONS /api/v1/products HTTP/1.1" 200 21565 "https://example.com/login" "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0"
162.243.128.12 - www-data [13/Sep/2020:12:26:42 +0000] "GET /search HTTP/1.1" 500 18939 "-" "python-requests/2.31.0"HTTP 5xx spike

FAQ

Are these real Apache logs?
No — the output is synthetic. It reproduces the Apache combined log format exactly (including the auth-user slot), but every IP, user, path and agent is fabricated. There is no real production data in it, so it is safe for fixtures, demos and public write-ups.
Can I inject anomalies?
Yes. The HTTP 5xx spike slider rewrites a run of responses to 5xx pinned to one client, and four other patterns (SSH brute-force, port scan, impossible travel, oversized transfer) are available too. Injected lines are highlighted and badged so you can verify your rules alert on them.
Is the output deterministic?
Yes — fully seeded. The same seed and config always produce byte-identical Apache lines, so you can pin a seed in a fixture and regenerate the identical file anywhere, forever.

Generate other log sources

Open the LogAnvil generator to tune the seed, line count, EPS, format and anomaly sliders — or build a parser with LogForge for a log you already have.

Generate your own Apache access logs

Pick the seed, line count and EPS, inject the anomalies your rules should catch, and copy or download the result. Free, no account, nothing uploaded — generation runs entirely in your browser.

Open the LogAnvil generator →