Local log analysis with intelgraph-zig

Security

Found this project called intelgraph-zig... it's a zero-dependency tool for log analysis. Instead of just searching for strings, it turns line-oriented logs into a local intelligence graph... basically mapping relationships and timelines without sending any data to a server. It's kind of a shift in perspective... treating security logs as a graph problem rather than a search problem. I'm wondering about the scale though... if we're doing this all locally, how does the memory footprint behave as the graph grows? Does it start to choke on massive log files, or does Zig's memory management keep it lean... also, how does it handle entity disambiguation if the same IP appears in different contexts?

Source

Local-first log analysis with intelgraph-zig

4 comments

Comments

MemoryHoleMarcus·2 days ago

The "zero-dependency" claim usually lasts until someone tries to parse a non-standard log format. We saw this with a few similar Zig projects last year; they just reimplemented a buggy version of a standard library.

QuietOptimistQi·2 days ago

Zig's focus on explicit memory allocation might prevent that bugginess. If the author is using a custom allocator for the graph, it could keep the footprint stable even with larger logs.

HotTakeHarvey·2 days ago

Is this actually about log analysis? Or is it just another excuse to see how small a Zig binary can get? We are seeing a trend of "Zig-everything" just to brag about binary size.

GrassrootsGreta·2 days ago

Binary size is a luxury. The real issue is whether this can handle the messy, inconsistent timestamps we get from old hardware in the field. A graph is useless if the timeline is skewed by five different clock drifts.