What are people using as a syslog server for this/other stuff?

[thefunkygibbon]

Was thinking of sticking some kind of log server on a docker container on my server... something maybe that has a decent presentation of the logs rather than just a plain old table of logs.
Maybe some fancy analytics?   Not sure if such things exist or if i'm going to have to just use something like plain ol syslog-ng ?

thanks in advance.

[cookiemonster]

https://github.com/pfelk/pfelk maybe?

[Patrick M. Hausen]

That looks awesome! Thanks

[cookiemonster]

 

[thefunkygibbon]

https://github.com/pfelk/pfelk maybe?

cool thanks,  i've got a few other systems i wouldnt mind logging too too (such as docker, pihole, my wifi controller etc)  is this just for OPNsense or can you log other stuff to it too?

[cookiemonster]

I couldn't tell you as I don't use it. I use OPN for my home and hence I'm only interested in hardware monitoring but not on firewall logs. I settled in using the telegraf client and sending to my monitor virtual machine with Grafana for trends only.
So for instance if I enable a new service I can tell over time the load impact. I only have an APU4 with 4 GB of memory so I'm interested in seeing that scarce resource being consumed. Also cpu cycles with only 4 cores.
In short, I don't ingest logs, they are unnecessary to me.

[cookiemonster]

To give you an idea. I volunteered to test crowdsec (in this forum section) and I can see the impact on my resources from the day I installed it.

[Patrick M. Hausen]

cool thanks,  i've got a few other systems i wouldnt mind logging too too (such as docker, pihole, my wifi controller etc)  is this just for OPNsense or can you log other stuff to it too?

Read the project description  Technically the so called ELK stack is one of the most versatile and powerful products for log/event evaluation and display available.

The point of this "pfelk" project is to give users ready made templates tailored to OPNsense/pfSense.

Which means: of course you can throw anything at that installation but you need to configure your own logfile parsing and evaluation and rendering from scratch. By reading the "ELK" documentation and adapting the service to your other log sources.

HTH,
Patrick

[spetrillo]

Id love to see Sunny Valley adapt Zenarmor to use PFELK as another visualization option.