MerlinLogs

Log analysis for VMware vSphere support bundles

Drop log files, folders or whole support bundles onto MerlinLogs: an ESXi vm-support, a vCenter vc-support, a sosreport, a folder of Windows event logs. It unpacks them, recognizes each log, and turns millions of lines into something you can read: one row per kind of message with a count, a timeline of errors per host, anomaly windows and the clock skew between hosts.

Then press Analyze with AI. MerlinLogs sends a redacted, condensed summary, never the raw logs, and Claude comes back with findings: what went wrong, the likely root cause, the log lines that prove it, and ordered mitigation steps with the commands marked read only or changes state. Click any piece of evidence to see the raw lines in the original file.

What leaves your PC, and what doesn't

• Nothing is sent until you press Send in the preview, which shows the exact text, the model and the estimated cost.
• Host names, IP addresses, user names, e-mail addresses, serial numbers and customer names are replaced with tokens like HOST_01 before anything is shown or sent. Passwords, keys, tokens and connection strings are always removed.
• A Local only switch per case keeps a case off the network entirely.
• Every request and response is saved in the case, so you can show a customer exactly what was sent.

Is it for you?

It's a good fit if you support VMware vSphere, VCF, vSAN or NSX, Windows or Linux servers, backup or automation platforms, and spend hours reading support bundles to find the one line that matters. It's built for consultants who need a report a customer can read.

It's probably not for you if you want live monitoring or alerting. MerlinLogs works on log files you already have; it doesn't collect logs or watch systems.

Features

Reading logs

• Unpacks .zip, .tgz, .tar, .gz, .7z and .bz2, including archives inside archives, and handles multi-GB bundles.
• ESXi and vCenter logs, vSAN, NSX, VCF, Aria and Horizon; Linux syslog, journald, dmesg and sosreport; Windows event logs (.evtx), CBS, DISM, cluster.log and IIS; Veeam, Zerto and Rubrik; Ansible, Terraform, Kubernetes and Docker; Cisco and syslog; CSV exports.
• Decodes SCSI sense data, storage path states, APD and PDL, HRESULTs and certificate expiry from local tables.

Finding problems

• 69 built-in rules for known infrastructure issues, such as APD and PDL, PSODs, HA isolation, expired certificates, NTP and DNS, each with an explanation and mitigation. Write your own rules in YAML and test them against a case before saving.
• AI findings with severity, root cause, evidence and verification steps. References are marked unverified unless a web search confirms them on vendor documentation.
• A chat for follow-up questions, such as "Why did HA restart these VMs?". Claude searches the case with local tools, and the answers link to the events.
• Compare two cases to see what is new, gone or changed, before and after a fix.

Reporting

• A Word report ready for a customer: findings table, details with evidence, timeline and a list of the data still needed. Also PDF, HTML, Markdown and JSON.
• Keep redaction in a report when it goes outside your team.
• A merlinlogs command for scripts: analyze a bundle and write a report in one line.

Price

Free. No trial, subscription, account or ads.

AI analysis uses your own Anthropic API key, billed by Anthropic, or your Claude Code subscription. MerlinLogs shows the estimated cost before every request and can stop at a monthly spending cap you set. Everything else runs on your PC and costs nothing.

Privacy

• Logs are read and stored on your PC, in a case folder you choose. Deleting a case deletes its copies; your original files are never touched.
• Only the redacted, condensed summary in the preview is sent, and only to the AI you chose in Settings. With a local model on your own PC, nothing leaves it.
• Your API key is stored encrypted for your Windows account. MerlinLogs collects no usage data and doesn't check for updates.

Requirements

Install

1. Download the zip, extract it, and run the setup file inside. If Windows shows "Windows protected your PC", click More info, then Run anyway. The app isn't code-signed yet.
2. Setup can also put the merlinlogs command on your PATH.
3. Drop a log file or support bundle on the Home screen. For a first try without AI, choose Offline demo in Settings; to analyze with Claude, add your API key or choose Claude Code.

SHA-256 of the setup file inside the zip:

54B38A0DA1E323FCE3CE3A5A01ED564BA8DBE419F8D0C2939586DAB413F95C28

Known limitations

• Log formats follow documented and commonly seen layouts. A log a vendor words differently may be read as plain text; the rules match the wording they know.
• Redaction is pattern-based and can miss an unusual format. Check the preview before you send.
• Logs written in local time with no time zone are read as UTC.
• Local models give vaguer findings than Claude, and small ones may not follow the answer format.
• Windows event log messages come from the components installed on your PC, so events from software you don't have show their raw values.