Category Archives: Syslog

Are you new to syslog? You can find syslog tutorials for different logging use cases. These step-by-step guides will help you to create fancy results. Impress your colleagues. You can even download all configuration examples I made for free.

I use syslog-ng for these tutorials. Therefore if you still want to use rsyslog, then you are not looking for these tutorials.

Kibana dashboard for home network traffic

Monitor home network traffic with OpenWRT and Syslog-ng

I wanted to see what happens on my home network. Is there something going on I should be aware of? Is there any device which creates suspicious connections like phoning home? I will use OpenWRT and syslog-ng to get the answers and Elasticsearch to get analytics.Kibana dashboard showing data from OpenWRT traffic syslogs

SOHO routers are usually not really resourceful, neither is mine. Therefore I needed a solution using as little resource as possible but still capable to answers that questions. My solution uses connection tracking data from the main OpenWRT router. Offload the information from OpenWRT to a central syslog server. Enrich it with GeoIP, Reverse DNS and session length metadata by using syslog-ng. Then analyze the logs with Elasticsearch.

The first part of this blog series answers where the packets come and go and some metrics. What are inside the packets is up to another posts. Continue reading

Visualize and analyze NGINX access logs in Kibana

Visualizing NGINX access logs in Kibana

Visualizing NGINX access logs in Kibana is one of my most visited post in my blog. It is time for a major update. This guide can easily be added into a central log server where someone already collects logs of Docker containers. Especially because it is quite common to run web servers in containerized systems. This tutorial shows you how to parse access logs of NGINX or Apache with syslog-ng and create ECS compatible data in Elasticsearch. I also describe how visualizing NGINX access logs in Kibana can be done.

Continue reading

Fail2ban vvisualization in Kibana Coordinate map

Visualizing Fail2ban logs in Kibana

In the last post I wrote about how you can create a central syslog server. This time I will show you how you can use syslog-ng to parse fail2ban log messages, enrich it with GeoIP metadata and send into Elasticsearch. You can even visualizing Fail2ban logs in Kibana to see where the failed login attempts are coming from.

Update: This post has been reviewed and all Fail2ban and GeoIP related contents have been merged here from the previous post. Look no further, you will find everything you need here. Note that this guide requires Elasticsearch 7.x.

Continue reading

A pile of timber logs

Creating a central syslog server

Your home network might already contain some devices or systems like a home server, a WiFi router, a media player, or home automation system. It is a best practice creating a central syslog server and storing logs of various sources in one place.

Update: The fail2ban and GeoIP related contents have been merged into post visualizing Fail2ban logs in Kibana.

This post will cover the basics. Creating a central log server and receiving logs from an OpenWRT device. Please note that you can do many more. See the other posts I created in this subject.

Continue reading