RCW IT Training← Back to catalogue
FREE TOOL • LINUX LOG ANALYSIS • 100% OFFLINE

RCW-NixDetect v1.0.0

A portable Windows utility that finds the root cause of Linux problems. Copy the logs to Windows, describe the issue in plain English — get a ranked root-cause report with evidence, correlations and fix actions. Single .exe, no installation, no internet required.

Download RCW-NixDetect.exe (2.6 MB)How it worksTrust & Verification

Prompt-driven root cause analysis

You don't grep through thousands of log lines — you just describe the symptom you saw, and RCW-NixDetect ranks what actually caused it. It understands problem intent (crash, memory, storage, network, security…), a time focus like “around 3am on Aug 12”, and hostnames/process names in your prompt.

You: "server froze around 3am on Aug 12 and had to be rebooted"
→ Scans syslog / auth.log / dmesg • filters evidence to your time window

→ PRIMARY ROOT CAUSE: Out of memory — kernel OOM killer (91%)
→ Killed: mysqld (4x), java (1x) • Secondary: disk I/O errors on sda (79%), SSH brute force (87%)
→ Fixes: tune memory limits, check SMART on sda, install fail2ban…
Memory / OOMDisks & I/OFilesystemsKernel panicssystemd servicesSSH & securityNetwork / DNS / NFSHardware / ECC / thermalSegfaults

Built for real incidents

Correlation rules connect the dots: I/O errors plus EXT4 errors on the same device → failing disk. A brute-forcing IP that later logs in successfully → flagged as a likely compromise. OOM kills plus status=9/KILL service failures → memory exhaustion is the real culprit, not a service bug.

How it works

  1. Copy Linux logs to Windows — plain files, a folder, rotated .gz, .zip or .tar.gz bundles (sudo tar czf logs.tgz /var/log then scp/WinSCP).
  2. Open cmd/PowerShell next to the exe and run it with your problem description:
    C:\> RCW-NixDetect.exe -l logs.tgz -p "server froze around 3am on Aug 12"

 VERDICT: Out of memory - kernel OOM killer active (91% confidence).
 Secondary issues: SSH brute force (87%); Disk I/O errors on sda (79%).

 >> PRIMARY ROOT CAUSE
    [CRIT] memory   Out of memory - kernel OOM killer active
    The kernel OOM killer terminated: mysqld (4x), java (1x). The system
    exhausted RAM+swap and killed the highest-scoring victims - this
    explains the freezes and the services that went down.

 Correlations: I/O errors + EXT4 errors on sda -> failing disk.
    Successful login from brute-force IP 203.0.113.77 - likely compromise.

 Recommended actions:
    [ ] Profile the top victim's memory (leak vs growth)
    [ ] Set systemd MemoryMax= limits so one workload can't starve the host
  3. Read the verdict, evidence lines (with file:line) and the fix checklist — or double-click the exe for guided interactive mode.
  4. Export a shareable report: -r report.html (also .txt / .md / .json), or --json for pipelines.
Note: heuristic catalog-based analysis (30 checks across memory, storage, filesystem, kernel, services, security, network, hardware and applications). The report always shows the raw evidence lines so you can verify every conclusion.

What it detects