MCP Log Analyzer

A Model Context Protocol (MCP) server for analyzing different types of logs on Windows systems, built with the FastMCP framework.

Features

• Multiple Log Format Support

  • Windows Event Logs (EVT/EVTX)

  • Windows Event Trace Logs (ETL)

  • Structured Logs (JSON, XML)

  • CSV Logs

  • Unstructured Text Logs

• MCP Tools

  • register_log_source: Register new log sources

  • list_log_sources: View all registered sources

  • get_log_source: Get details about a specific source

  • delete_log_source: Remove a log source

  • query_logs: Query logs with filters and pagination

  • analyze_logs: Perform analysis (summary, pattern, anomaly)

• MCP Resources

  • logs://sources: View registered log sources

  • logs://types: Learn about supported log types

  • logs://analysis-types: Understand analysis options

  • system://windows-event-logs: Recent Windows System and Application event logs

  • system://linux-logs: Linux systemd journal and application logs

  • system://process-list: Current processes with PID, CPU, and memory usage

  • system://netstat: Network connections and statistics for troubleshooting

• MCP Prompts

  • Log analysis quickstart guide

  • Troubleshooting guide

  • Windows Event Log specific guide

Related MCP server: Filesystem MCP Server

Installation

Windows Setup

On Windows, the package includes Windows Event Log support via pywin32. If you encounter import errors:

Note: On first install of pywin32, you may need to run the post-install script:

Usage

Understanding MCP Servers

MCP (Model Context Protocol) servers don't have traditional web endpoints. They communicate via stdin/stdout with MCP clients (like Claude Code). When you run python main.py, the server starts silently and waits for MCP protocol messages.

Testing the Server

Starting the MCP Server

Using with Claude Code

1. Add the server to Claude Code:

   claude mcp add mcp-log-analyzer python /path/to/main.py

2. Use the tools in Claude Code:

   • Register a log source: Use the register_log_source tool

   • Query logs: Use the query_logs tool

   • Analyze logs: Use the analyze_logs tool

3. Access resources:

   • Reference resources using @mcp-log-analyzer:logs://sources

   • Get help with prompts like /mcp__mcp-log-analyzer__log_analysis_quickstart

System Monitoring Resources

These resources provide real-time system information without needing to register log sources:

1. Check System Processes:

   • Access via @mcp-log-analyzer:system://process-list

   • Shows top processes by CPU usage with memory information

2. Windows Event Logs (Windows only):

   • Default: @mcp-log-analyzer:system://windows-event-logs (last 10 entries)

   • By count: @mcp-log-analyzer:system://windows-event-logs/last/50 (last 50 entries)

   • By time: @mcp-log-analyzer:system://windows-event-logs/time/30m (last 30 minutes)

   • By range: @mcp-log-analyzer:system://windows-event-logs/range/2025-01-07 13:00/2025-01-07 14:00

   • Shows System and Application event log entries

3. Linux System Logs (Linux only):

   • Default: @mcp-log-analyzer:system://linux-logs (last 50 lines)

   • By count: @mcp-log-analyzer:system://linux-logs/last/100 (last 100 lines)

   • By time: @mcp-log-analyzer:system://linux-logs/time/1h (last hour)

   • By range: @mcp-log-analyzer:system://linux-logs/range/2025-01-07 13:00/2025-01-07 14:00

   • Shows systemd journal, syslog, and common application logs

4. Network Monitoring (Cross-platform):

   • Default: @mcp-log-analyzer:system://netstat (listening ports)

   • Listening ports: @mcp-log-analyzer:system://netstat/listening

   • Established connections: @mcp-log-analyzer:system://netstat/established

   • All connections: @mcp-log-analyzer:system://netstat/all

   • Network statistics: @mcp-log-analyzer:system://netstat/stats

   • Routing table: @mcp-log-analyzer:system://netstat/routing

   • Port-specific: @mcp-log-analyzer:system://netstat/port/80

   • Uses netstat on Windows, ss (preferred) or netstat on Linux

Time Format Examples:

• Relative time: 30m (30 minutes), 2h (2 hours), 1d (1 day)

• Absolute time: 2025-01-07 13:00, 2025-01-07 13:30:15, 07/01/2025 13:00

Example Workflow

1. Register a Windows System Log:

   Use register_log_source tool with: - name: "system-logs" - source_type: "evt" - path: "System"

2. Query Recent Errors:

   Use query_logs tool with: - source_name: "system-logs" - filters: {"level": "Error"} - limit: 10

3. Analyze Patterns:

   Use analyze_logs tool with: - source_name: "system-logs" - analysis_type: "pattern"

4. Register an ETL File:

   Use register_log_source tool with: - name: "network-trace" - source_type: "etl" - path: "C:\\Traces\\network.etl"

Development

Project Structure

• src/mcp_log_analyzer/: Main package

  • mcp_server/: MCP server implementation using FastMCP

  • core/: Core functionality and models

  • parsers/: Log parsers for different formats

• main.py: Server entry point

• .mcp.json: MCP configuration

• tests/: Test files

Requirements

• Python 3.12+

• Windows OS (for Event Log support)

• See pyproject.toml for full dependencies

License

MIT