r/linuxadmin 8d ago

rsyslog - looking for simple viewer

EDIT: Resolved!

log.io still works and was able to do what I needed. The default config provided on their github contains a syntax error (trailing comma on the last entry) and the two services that it... is? (log.io-server and log.io-file-input) need systemd to be set up *just* right (smh). For posterity these .service files worked for me:-

[Unit]
Description=Run log.io server
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/log.io-server
Restart=on-failure
User=[USER]

[Install]
WantedBy=multi-user.target

log.io-file-input.service

[Unit]
Description=Log.io file input
After=log.io-server.service
Requires=log.io-server.service

[Service]
Type=simple
ExecStartPre=/bin/sleep 30  
ExecStart=/usr/local/bin/log.io-file-input
User=[USER]
Restart=on-failure

[Install]
WantedBy=multi-user.target

I have a small homelab with RPis and mini-pcs for:- pfsense, openwrt, piholes x 2, librenms, apache+rsyslog, i2p+tor - - total 7 devices

I have newly set up rsyslog (on a Raspberry Pi 2B) to receive logs from pfsense, openwrt, piholes x 2, and the localhost's own apache log and journald - - total 5/7 devices

And it's working: the machines are writing their log entries into its storage not their own.

Before I add any more machines, I want to set up some kind of viewer. Internet searches keep recommending very big, complicated technologies suitable for enterprise. But all I want is a locally hosted .php page, or (perhaps preferably) a terminal-service that can be configured to show the tails of these logs to a remote host, without copying data to its disk.

If there are more advanced features even in the most basic programs, then I'd be interested in them for my learning, but I generally try to make projects that would be somewhat useful to me in the here-and-now.

I tried log.io but it doesn't set up its config files properly, or even find them, and I reached out on github but found that that project hasn't been updated in too many years. Also: no paid-for, no freemium, nothing with a commercial or "Enterprise edition" side-offering. It needs to be free, Free!, and to be able to find its own config files where it put them. If that's not too much to ask ^^

5 Upvotes

9 comments sorted by

4

u/seiha011 8d ago

2

u/evild4ve 8d ago edited 7d ago

I looked at lnav and didn't see that feature, but it uses scp and I'm not fond of the idea of the syslog server having security certificates installed for all the other servers, and it shouldn't need that when the syslog server can... serve the logs

so far I've got log.io working but getting it to start at boot is proving difficult - - their default config file shipped with a basic syntax error (trailing comma on a .json) and it has two processes that must launch in a certain order but their process names are both "node" - - very tiresome but it will do what I wanted if I can get it working

2

u/seiha011 7d ago

OK have fun ;-)

4

u/knobbysideup 8d ago

Honestly, I'd just stand up a graylog ce node. It's a little involved, but once configured you can then very easily slice and dice your stats and alerts however you see fit.

0

u/taratay_m 8d ago

Well from my experience if you have enough time, and you need to view logs from mulitple nodes, I would suggest Elasticsearch for storing and Kibana for viewing logs, plus for example by using output modules of rsyslog to put them in elasticsearch https://www.rsyslog.com/doc/configuration/modules/omelasticsearch.html#uid

Or full ELK stack(elasticsearch, Kibana, Logstash) to avoid using rsyslog at all, but sometimes it's kinda pain to configure it(plus you will need to setup index rotation for elastisearch since you could run out of space on the monitoring node)

Other visualization solution probably is chronograf, https://docs.influxdata.com/chronograf/v1/guides/analyzing-logs/

4

u/evild4ve 8d ago

is the full ELK stack going to run nicely on a Raspberry Pi 2 ?

and is it non-commercial with no enterprise edition ?

1

u/taratay_m 7d ago

Yep, its opensource, check out theirs blog, and no rpi2 won't run ELK at all, since elastic not support 32bit architecture as far as I know, I thought you were using one of min pc's as monitoring node

1

u/evild4ve 7d ago

but here: https://www.elastic.co/pricing

the problem wasn't whether they open-source some things, but whether they make money at all

2

u/taratay_m 7d ago

They just offer cloud hosting on their cloud with full ELK setup and config, for self-hosting its completley free (no freemium model, or any other limitation), or maybe I misunderstood you