Log File Generator
Generate realistic mock log files for testing, development, and demos. Choose a log format, set the options, and download or copy the output — all in your browser, nothing sent to a server.
Options
1 – 5,000 lines
Output
Supported Log Formats
Apache / Nginx Combined Access Log
The most common web server log format. Each line records a single HTTP request: client IP, timestamp, request method + path, HTTP status code, response size, referer, and user agent. Follows the Combined Log Format (%h %l %u %t "%r" %s %b "%{Referer}i" "%{User-agent}i"), which both Apache and Nginx support natively.
Apache Error Log
Records server-side errors, PHP fatal errors and warnings, permission denials, and ModSecurity blocks. Includes severity level (error, warn, notice, info), PID, and client IP.
Nginx Error Log
Nginx error entries include upstream connection failures, FastCGI errors, SSL handshake failures, and rate limiting events. Uses ISO timestamp format and connection IDs prefixed with *.
SSH / Auth Log (auth.log)
Models Debian/Ubuntu /var/log/auth.log entries for SSH sessions: accepted/failed password authentication, accepted public key, invalid user attempts, and session open/close events. Adjust the error rate to control the ratio of failed authentication attempts — useful for simulating brute force attack scenarios.
Linux Syslog
Standard syslog format with hostname, process name, and PID. Includes messages from kernel, cron, sudo, systemd, sshd, and Postfix — typical for a production Linux server.
MySQL Error Log
MySQL 8-style error log with ISO timestamp, thread ID, severity (ERROR/WARNING/NOTE), error code, and component tag. Includes InnoDB, authentication, replication, and connection errors.
PostgreSQL Log
PostgreSQL log entries with UTC timestamp, PID, and message. Covers FATAL authentication errors, constraint violations, connection events, autovacuum, and checkpoint logs.
Common Use Cases
- Log parsing development: Test your regex patterns, log parsers, and ingestion pipelines against realistic data before connecting to a live source. For structured test datasets (JSON, CSV, SQL), the Mock Data Generator complements log files well.
- SIEM and alerting rules: Feed mock data into Splunk, Elastic/OpenSearch, Graylog, or Datadog during development to validate detection rules without using production data.
- Demos and screenshots: Populate monitoring dashboards or log viewers with realistic-looking data for presentations and product screenshots.
- Security training: Provide students or trainees with log files containing hidden attack patterns (brute-force SSH attempts, web scanning, SQL injection signatures) to practice threat hunting and incident analysis.
- Load testing log shippers: Generate large log files to benchmark the throughput of log shippers like Filebeat, Fluentd, or Vector.
- Documentation: Include realistic log snippets in runbooks, wiki articles, and README files without exposing real server or user data.
Frequently Asked Questions
Are the IP addresses real?
Public IPs are randomly generated and will not correspond to any real host. Private IPs (192.168.x.x, 10.0.1.x) follow standard RFC 1918 ranges but are similarly random. No real system or user data is used.
How does the error rate work?
For access logs, the error rate controls the percentage of HTTP 4xx/5xx responses. For auth logs, it controls the percentage of failed/invalid login attempts. Set it higher to simulate attack traffic or an unstable service.
Can I generate very large files?
Up to 5,000 lines can be generated at a time. For larger files, generate multiple batches and concatenate them. A typical Apache access log line is about 200–300 bytes, so 5,000 lines produces roughly 1–1.5 MB.
Are the timestamps in order?
Lines are sorted alphabetically after generation, which approximates chronological order for most formats. For strict chronological ordering, import the file into a log tool and sort by the parsed timestamp field. If your logs use epoch timestamps, the Unix Timestamp Converter can translate them to readable dates.
