LogScrub Help

Why Use LogScrub?

Every day, developers and IT professionals need to share logs for debugging, support tickets, bug reports, and collaboration. But logs often contain sensitive information that shouldn't be shared.

Common Scenarios

Why Client-Side Processing Matters

Many log sanitization tools require uploading your logs to a server. This defeats the purpose — you're sharing sensitive data with yet another third party.

LogScrub processes everything in your browser using WebAssembly. Your logs never leave your device. You can even use it offline or on an air-gapped machine.

Preserving Log Usefulness

The goal isn't just to remove data — it's to keep logs useful for their intended purpose:

• Consistency Mode ensures the same email always becomes [EMAIL-1], so you can still trace a user's journey
• Time Shift lets you anonymize timestamps while preserving the relative timing between events
• Log Crop trims log files to a specific time window, so you only share the relevant portion
• Selective Rules let you keep non-sensitive data like UUIDs or timestamps when needed for debugging

Quick Start

LogScrub helps you remove personally identifiable information (PII) and sensitive data from log files before sharing them.

Basic Workflow

1. Paste or upload your log content into the "Original" pane
2. Review detection rules by clicking the Rulesets button (toggle rules on/off, review matches)
3. Click "Scrub" or press ⌘/Ctrl + Enter
4. Copy or download the scrubbed output

How It Works

LogScrub uses pattern matching to identify sensitive data in your text. Each detection rule has a regular expression (regex) that matches specific data formats.

Processing Pipeline

1. Pattern Matching — Each enabled rule's regex is applied to find matches
2. Replacement — Matched text is replaced according to your chosen strategy
3. Consistency — When enabled, identical values get identical replacements

Replacement Strategies

Choose how detected PII should be replaced:

Fake Data Generation

The Fake strategy uses a Rust-based data generation library to create realistic-looking replacements. This makes your scrubbed output look natural while still protecting sensitive information. Fake data is generated deterministically — the same input always produces the same fake output, ensuring consistency.

Fake (Country) — Preserve Country Prefixes

The Fake (Country) strategy extends the Fake strategy by preserving country-specific prefixes. This is useful when you need to keep geographic context (e.g. which country a phone number belongs to) while still anonymizing the rest of the data.

Consistency Mode

When enabled, the same input value always produces the same replacement. This preserves relationships in your data:

Detection Rules Reference

LogScrub includes 95+ built-in detection rules organized by category.

Custom Rules

Create your own detection rules using regular expressions for patterns specific to your organization.

Adding a Custom Rule

1. Click the "+ Regex" button in the Rulesets panel (Custom Rules tab)
2. Enter a descriptive name for the rule
3. Enter your regex pattern (JavaScript syntax)
4. Click "Add Rule"

Example: Company Employee IDs

Example: Internal Hostnames

Plain Text Patterns

For exact text matches that don't require regex (like specific hostnames or identifiers), use Plain Text patterns.

Adding a Plain Text Pattern

1. Click the "+ Text" button in the Rulesets panel (Custom Rules tab)
2. Enter a label for the pattern
3. Enter the exact text to match
4. Click "Add Pattern"

When to Use Plain Text vs Regex

Presets

Presets let you save and quickly switch between different rule configurations.

Built-in Presets

• Minimal — Only critical PII (emails, SSN, credit cards)
• Standard — Common PII without dates/paths
• Paranoid — Everything enabled for maximum redaction
• Dev/Debug — Focus on secrets, tokens, and credentials
• GDPR — EU personal data (includes UK postcodes, IBAN)

Custom Presets

Save your current rule configuration as a preset:

1. Configure your rules as desired
2. Click "Presets" to expand the presets panel
3. Enter a name and click "Save"

Import/Export

Share configurations between computers or team members using JSON export/import.

Multi-File Upload

Process multiple log files at once with batch operations. Upload files individually or as a ZIP archive, analyze and scrub them all together, and export the results as a single ZIP download.

Uploading Multiple Files

There are several ways to upload multiple files:

• File picker — Click "Upload" and select multiple files (hold Ctrl/Cmd to select multiple)
• Drag and drop — Drag multiple files onto the editor area
• ZIP archive — Upload a .zip file containing text files (they will be automatically extracted)

Supported file types: .log, .txt, .json, .xml, .csv, .sql, .zip

Files Tab

When you upload multiple files, a "Files" tab appears:

• File list — Shows all uploaded files with their names, sizes, and status
• Status badges — Pending, Analyzing, Analyzed, Processing, Done, or Error
• Detection count — Shows how many PII items were found in each file
• File selection — Click a file to view it in the editor
• Remove files — Click the X button to remove individual files, or "Clear All" to start over

Batch Operations

Process all files at once using the batch buttons at the top of the Files tab:

• Analyze All — Run detection on all files to see what PII will be found (preview mode)
• Scrub All — Process all files with your current rule settings
• Export ZIP — Download all scrubbed files as a single ZIP archive

A progress bar shows which file is currently being processed during batch operations.

File Navigation

When in multi-file mode, a navigation bar appears above the editor showing:

• Current file name
• Position indicator (e.g., "2 of 5")
• Previous/Next buttons to quickly switch between files

Combined Statistics

The Statistics view includes a toggle to show stats for either:

• Current File — Detection counts for the currently selected file
• All Files — Combined totals across all uploaded files

Cross-File Consistency

When Consistency Mode is enabled, the same PII value will receive the same replacement across ALL files in the batch. For example, if john@example.com appears in multiple files, it will always be replaced with [EMAIL-1] in every file.

Organizing Rules

Customize the order of rule categories and individual rules to match your workflow.

Reordering Categories

Drag categories to change their display order:

1. Grab the drag handle (⋮⋮) to the left of a category name
2. Drag the category up or down to your preferred position
3. Release to drop it in place

Reordering Rules Within a Category

1. Expand the category by clicking its name
2. Grab the drag handle (⋮) to the left of a rule
3. Drag the rule up or down within the category
4. Release to set its new position

Persistence

Your custom ordering is automatically saved to your browser's local storage and will be restored on your next visit. When you save a preset, the ordering is included.

Time Shift

Timestamps in logs can reveal when incidents occurred, work patterns, or timezone information. Time Shift lets you anonymize temporal data while preserving the relative timing between events.

Supported Timestamp Formats

• ISO 8601 — 2024-01-15T10:30:00Z
• ISO Date — 2024-01-15
• Apache error log — [Sat Aug 12 04:05:51 2006]
• Apache access log — [17/May/2015:10:05:03 +0000]
• Syslog — Jan 15 10:30:00
• US Format — 01/15/2024 10:30:00

Offset Mode

Shift all timestamps by a fixed amount. Useful when you want to obscure the actual date/time while keeping the duration between events accurate.

Start From Mode

Set the first timestamp to a specific date/time. All subsequent timestamps shift by the same amount, preserving relative timing.

Scope: Line Start vs All Timestamps

Logs often contain two types of timestamps:

• Log timestamps — At the start of each line
• Content dates — Within the log message itself (DOBs, expiry dates, etc.)

Log Crop

When working with large log files that span many hours or days, you often only need a specific time window. The Crop tool lets you trim a log file to a precise time range, keeping only the lines you need.

How to Use

1. Paste or upload a log file with timestamps
2. Click the Crop link above the Original pane
3. Review the detected time range, duration, and line count
4. Select the time window you want to keep
5. Click Crop to trim the log

Custom Range

Set a specific start and end time to keep. Any lines with timestamps outside this range are removed. Lines without timestamps (such as stack traces or continuation lines) are kept if they follow a line within the selected range.

Start + Duration

Select a start time and then choose a duration preset. This is useful when you know the approximate start of an incident and want to capture a fixed window of time.

Available presets: 1 minute, 5 minutes, 15 minutes, 30 minutes, 1 hour, 2 hours, 4 hours, 8 hours, 12 hours, and 24 hours.

Analyze Mode

Preview detections before scrubbing to fine-tune your rules.

Using Analyze

1. Paste your content
2. Click "Analyze" above the Original pane
3. Review highlighted matches (shown in red)
4. Check the suggestions for disabled rules that would match
5. Adjust rules as needed, then Scrub

Smart Suggestions

After analysis, LogScrub suggests disabled rules that found matches in your text. This helps you discover rules you might want to enable.

Log Format Detection

When you run Analyze, LogScrub automatically detects common log formats and offers to load a suitable preset. This saves time by enabling the most relevant rules for your log type.

When a log format is detected, a colored banner appears above the editor with a button to load the recommended preset. You can dismiss the banner if you prefer to configure rules manually.

ML Name Detection

LogScrub includes optional machine learning-based detection for identifying person names, locations, and organizations that pattern-based rules might miss.

How It Works

ML Name Detection uses a pre-trained Named Entity Recognition (NER) model to identify entities in text:

• PER (Persons) - Names of people (e.g., "John Smith", "Dr. Sarah Johnson")
• LOC (Locations) - Place names (e.g., "London", "Silicon Valley")
• ORG (Organizations) - Company and organization names (e.g., "Microsoft", "NHS")

Technology

• Library: Transformers.js by Hugging Face
• Model: BERT-based NER models (DistilBERT or BERT Base)
• Format: ONNX for efficient browser execution via WebAssembly
• Caching: Models are cached in IndexedDB after first download

Enabling ML Detection

1. Click the Settings button in the toolbar
2. Select a model under ML Name Detection (DistilBERT recommended for balance of speed/accuracy)
3. Click Download Model (only required once — cached models auto-load on startup)
4. Once "Ready" appears, click Run ML Analysis or it will run automatically during Analyze

Available Models

ML Detection Rules

When ML detection is enabled, three additional rules appear in the ML Detection category:

• Person Names (ML) - Names identified by the ML model
• Locations (ML) - Place names identified by the ML model
• Organizations (ML) - Company/org names identified by the ML model

These rules are automatically enabled when you turn on ML Name Detection, but you can disable individual entity types if needed.

When to Use ML Detection

ML detection is most useful when:

• Text contains person names not in email or username formats
• You need to detect organization names
• Location names need to be identified
• Pattern-based rules are missing names in free-form text

Syntax Validation

LogScrub automatically validates the syntax of structured file formats when you paste or upload content. This helps catch malformed files before processing.

Supported Formats

• JSON - Objects, arrays, and nested structures
• XML - Including SVG, HTML, GPX, and other XML-based formats
• CSV - Validates consistent column counts across rows
• YAML - Configuration files and structured data
• TOML - Configuration files (e.g., Cargo.toml, pyproject.toml)

Format Detection

The format is detected automatically by:

1. File extension - When you upload a file, the extension determines the format
2. Content analysis - For pasted content, LogScrub examines the structure (e.g., starts with { or [ for JSON, < for XML)

Validation Results

After analysis completes:

• Valid syntax - A green checkmark appears next to the "Original" heading. Hover over it to see the detected format (e.g., "Valid JSON syntax").
• Invalid syntax - A red error banner appears showing the format, line number, column number, and error message. Click the line number to scroll directly to the error location.

Context-Aware Detection

Beyond regex patterns, LogScrub can detect potential secrets by analyzing JSON structures and identifying suspicious key names. This is especially useful for structured logs that contain key-value pairs.

How It Works

When you run Analyze, LogScrub automatically:

1. Detects JSON content in your text (pure JSON, NDJSON, or embedded JSON in log lines)
2. Parses the JSON and walks through all key-value pairs
3. Flags values associated with suspicious keys like "password", "token", "api_key", etc.
4. Shows findings in the Context-Aware tab within Smart Suggestions

Supported JSON Formats

Suspicious Keys

LogScrub looks for keys that commonly contain sensitive data:

Using Context-Aware Findings

After analysis, check the Context-Aware tab in Smart Suggestions. Each finding shows:

• Key name — The suspicious key that triggered detection
• Confidence level — High (exact match) or Medium (pattern match)
• JSON path — Full path like config.database.password
• Value preview — A sample of the detected value

Click "Add to scrub" to create a plain-text pattern that will redact that specific value. This is useful when you find a secret that wasn't caught by the regex-based rules.

Complementing Regex Detection

Context-aware detection complements (not replaces) the regex-based rules:

• Regex rules — Detect secrets by their format (JWT structure, API key prefixes, etc.)
• Context-aware — Detect secrets by their semantic context (what key they're assigned to)

Using both approaches together provides more comprehensive coverage for secrets that might not have a recognizable format but are stored under suspicious key names.

Email Header Analysis

When LogScrub detects email headers (multiple Received: headers), it offers to visualize the email's routing path through mail servers.

Email Routing Visualization

Click "View Email Routing" in the blue banner to open a visual diagram showing:

• Server chain — Each mail server the message passed through, from origin to destination
• Timestamps — When each server received the message
• Transit time — Duration between each hop (shown on the connector lines)
• TLS encryption — A padlock icon indicates encrypted transmission, with TLS version and cipher details on hover
• Protocol — The mail protocol used (SMTP, ESMTP, LMTPS, etc.)

What Gets Parsed

Understanding the Diagram

The routing diagram reads from top to bottom:

1. Origin — The sending server (extracted from the first Received: header's "from" field)
2. Intermediate servers — Mail relays, spam filters, or corporate gateways
3. Destination — The final receiving server

Use Cases

• Debugging email delivery — Identify where delays occur in the delivery chain
• Security analysis — Verify TLS encryption was used throughout the route
• Spam investigation — Trace the origin of suspicious emails
• Compliance — Document that email was transmitted securely

Spam Report Parsing

LogScrub detects and parses spam filter reports from SpamAssassin and rspamd, displaying them in an easy-to-read sortable table.

Supported Formats

Report View Features

• Sortable table — Click column headers to sort by rule name or score
• Color-coded rules — Green for ham (negative scores), red for spam (positive scores)
• Total score — Combined score with visual indicator
• Action taken — Shows what the filter decided (no action, add header, reject, etc.)
• Rule breakdown — Count of ham, neutral, and spam rules

Multi-line Headers

Spam reports are often split across multiple lines in email headers. LogScrub automatically handles header continuation lines (lines starting with whitespace) and reassembles the complete report.

Multiple Reports

Some mail systems run multiple spam filters. When both SpamAssassin and rspamd reports are present (e.g., X-Spam-Report and X-Spam-Report-Secondary), LogScrub detects both and displays them with tabs to switch between the two reports for comparison.

GPX Route Transposition

GPX files contain GPS track data from fitness devices, cycling computers, and navigation apps. When sharing routes for debugging or analysis, you may want to hide your actual location while preserving all other statistics.

How It Works

When LogScrub detects a GPX file (by extension or content), a green banner offers to transpose the route to a different continent. The transposition:

• Shifts all coordinates — Moves the entire route to a new location
• Preserves route shape — All turns, distances, and geometry remain identical
• Keeps timestamps — Duration and timing data unchanged
• Retains elevation — All elevation data preserved
• Includes waypoints — Waypoints and route points also transposed

Destination Regions

Choose from six destination regions:

Route Statistics

Before transposition, the modal displays:

• Track name and detected region
• Number of GPS points
• Total duration
• Elevation range
• Center coordinates

Shifting Timestamps

GPX files also contain timestamps for each point. Use the Time Shift feature (in the toolbar) to shift all timestamps by a fixed offset or to a new start date. This adds another layer of privacy by obscuring when the activity occurred.

More GPX/FIT Tools

For more advanced GPX and FIT file manipulation (merging, splitting, editing, converting), visit skeffling.net/gpxfit.

Audit Reports

Generate detailed reports of all detected PII for compliance documentation.

Report Contents

• Timestamp and source file name
• Summary of detection counts by type
• List of unique detected values (up to 100 per type)

Export Formats

• Text (.txt) — Plain text, easy to read
• JSON (.json) — Machine-readable, for integration
• HTML (.html) — Formatted report for sharing

Access audit reports by clicking the detection count badge, then "Download Audit Report".

RTF Export with Highlighting

For a visual export of your scrubbed output, use the rtf download button (shown in green). This generates a Rich Text Format file with all replacements highlighted in green, matching the diff view appearance.

• Visual review — Easily spot all changes at a glance
• Shareable — RTF opens in Word, LibreOffice, TextEdit, and most word processors
• Printable — Great for compliance documentation or review meetings

The RTF export uses a light green background with dark green text for replacements, making it easy to see what was scrubbed while keeping the document readable.

Reverse Lookup

When sharing scrubbed logs with others for analysis, you may receive feedback like "the IP on line 100 is causing the issue." LogScrub provides several ways to map scrubbed values back to their originals.

Hover Tooltips

Hover your mouse over any replacement in the scrubbed output (e.g., [IP-1]). A tooltip will show the original value, type, and line numbers.

Mapping Table

For a complete overview, open the Stats panel and click the Mapping tab. This shows a searchable table with every unique replacement.

Export Mapping Dictionary

1. Open Stats → Mapping tab
2. Click Export
3. Choose JSON (for scripts) or CSV (for spreadsheets)

{
  "[EMAIL-1]": {
    "original": "john.doe@example.com",
    "type": "email",
    "count": 3,
    "lines": [12, 45, 89]
  }
}

AI Explain

When sharing scrubbed logs with AI assistants like ChatGPT, Claude, or Copilot, they need context to understand the redaction format. The AI Explain feature generates a ready-to-use explanation.

How to Use

1. Scrub your log as usual
2. Click the "AI Explain" button in the scrubbed output toolbar
3. Copy the generated explanation
4. Paste it into your AI chat before pasting the scrubbed log

What's Included

The generated explanation includes:

• Replacement strategies — Describes each strategy used (Label, Fake, Fake (Country), Redact, Template)
• Consistency mode status — Tells the AI whether same tokens mean same values
• Detected types table — Lists each PII type found with its replacement strategy and example format
• Interpretation guidelines — Instructions for how the AI should reference replacements

## Log Redaction Context

This log has been sanitized using LogScrub...

### Detected & Replaced Data Types

| Type | Strategy | Example Replacement | Count |
|------|----------|---------------------|-------|
| Email | Label | `[EMAIL-1]` | 5 |
| IPv4 | Fake | `142.58.201.33` | 12 |
| Hostname | Template | `<HOSTNAME-1>` | 3 |

Documents & Spreadsheets

LogScrub can scrub PII from document and spreadsheet files, not just plain text. All processing happens client-side in your browser using WebAssembly.

Supported Formats

How Document Processing Works

PDF Files

PDFs are rendered using MuPDF (WebAssembly). Due to the complexity of PDF format, scrubbing uses redaction only — detected PII is covered with black boxes rather than replaced with labels or fake data. This ensures the document structure remains intact.

Word Documents (.docx)

DOCX files are ZIP archives containing XML. LogScrub extracts the document content, applies your scrubbing rules, and repackages the file. The preview uses the docx-preview library to show formatted content including bold, italic, tables, and images.

Excel Spreadsheets (.xlsx)

XLSX files are processed using excelize-wasm. Cell contents are scrubbed while preserving the spreadsheet structure, formulas references, and formatting. The preview shows a table view of each sheet.

OpenDocument Files (.odt, .ods)

LibreOffice/OpenOffice formats are ZIP archives with XML content, similar to Microsoft Office formats. LogScrub extracts and scrubs the content XML while preserving document structure.

Document Preview Features

• Split view — See original and scrubbed documents side by side
• ScrollSync — Original and scrubbed previews scroll together
• Resizable panels — Drag the resize handle to adjust preview height
• Match highlighting — PDF preview shows match count per page

Document Metadata

Documents often contain metadata that may include sensitive information:

• Author name and company
• Creation and modification dates
• Application used to create the document
• Revision history and editing time

When you upload a document, LogScrub automatically checks for metadata. If found, you'll see a dialog showing all detected metadata fields and can choose to:

• Remove Metadata — Strip all metadata from the downloaded file
• Keep Metadata — Preserve original metadata in the downloaded file

Downloading Scrubbed Documents

After scrubbing, click Download to save the sanitized document. The output file preserves the original format — a scrubbed .docx remains a .docx that can be opened in Word.

Keyboard Shortcuts

Working with Network Captures

LogScrub can scrub network packet captures (PCAP files), but they must first be converted to text format.

Converting PCAP to Text

Using tcpdump

tcpdump -r capture.pcap -tttt > capture.txt

Using tshark (Wireshark CLI)

tshark -r capture.pcap > capture.txt

Using Wireshark

1. Open the PCAP file in Wireshark
2. Go to File → Export Packet Dissections → As Plain Text
3. Save the text file, then upload to LogScrub

What Gets Detected

File Size & Performance

LogScrub runs entirely in your browser, so performance depends on your device's capabilities.

Tips for Large Files

• Close other browser tabs to free up memory
• Use a desktop browser rather than mobile
• Consider splitting extremely large log files
• The virtual scrolling feature helps keep the UI responsive

Privacy & Security

How We Protect Your Data

• Client-side processing — All scrubbing happens in your browser using WebAssembly
• No server communication — Your text never leaves your device
• No analytics on content — We don't track what you scrub
• Local storage only — Presets and settings are stored in your browser

Best Practices

• Always review the scrubbed output before sharing
• Use "Analyze" first to understand what will be detected
• Enable additional rules for sensitive data types not detected by default
• Add custom patterns for organization-specific identifiers
• Use the "Changed only" filter to quickly review modified lines