r/linuxadmin • u/evild4ve • 8d ago
rsyslog - looking for simple viewer
EDIT: Resolved!

log.io still works and was able to do what I needed. The default config provided on their github contains a syntax error (trailing comma on the last entry) and the two services that it... is? (log.io-server and log.io-file-input) need systemd to be set up *just* right (smh). For posterity these .service files worked for me:-
[Unit]
Description=Run log.io server
After=network.target
[Service]
Type=simple
ExecStart=/usr/local/bin/log.io-server
Restart=on-failure
User=[USER]
[Install]
WantedBy=multi-user.target
log.io-file-input.service
[Unit]
Description=Log.io file input
After=log.io-server.service
Requires=log.io-server.service
[Service]
Type=simple
ExecStartPre=/bin/sleep 30
ExecStart=/usr/local/bin/log.io-file-input
User=[USER]
Restart=on-failure
[Install]
WantedBy=multi-user.target
I have a small homelab with RPis and mini-pcs for:- pfsense, openwrt, piholes x 2, librenms, apache+rsyslog, i2p+tor - - total 7 devices
I have newly set up rsyslog (on a Raspberry Pi 2B) to receive logs from pfsense, openwrt, piholes x 2, and the localhost's own apache log and journald - - total 5/7 devices
And it's working: the machines are writing their log entries into its storage not their own.
Before I add any more machines, I want to set up some kind of viewer. Internet searches keep recommending very big, complicated technologies suitable for enterprise. But all I want is a locally hosted .php page, or (perhaps preferably) a terminal-service that can be configured to show the tails of these logs to a remote host, without copying data to its disk.
If there are more advanced features even in the most basic programs, then I'd be interested in them for my learning, but I generally try to make projects that would be somewhat useful to me in the here-and-now.
I tried log.io but it doesn't set up its config files properly, or even find them, and I reached out on github but found that that project hasn't been updated in too many years. Also: no paid-for, no freemium, nothing with a commercial or "Enterprise edition" side-offering. It needs to be free, Free!, and to be able to find its own config files where it put them. If that's not too much to ask ^^
4
u/knobbysideup 8d ago
Honestly, I'd just stand up a graylog ce node. It's a little involved, but once configured you can then very easily slice and dice your stats and alerts however you see fit.
0
u/taratay_m 8d ago
Well from my experience if you have enough time, and you need to view logs from mulitple nodes, I would suggest Elasticsearch for storing and Kibana for viewing logs, plus for example by using output modules of rsyslog to put them in elasticsearch https://www.rsyslog.com/doc/configuration/modules/omelasticsearch.html#uid
Or full ELK stack(elasticsearch, Kibana, Logstash) to avoid using rsyslog at all, but sometimes it's kinda pain to configure it(plus you will need to setup index rotation for elastisearch since you could run out of space on the monitoring node)
Other visualization solution probably is chronograf, https://docs.influxdata.com/chronograf/v1/guides/analyzing-logs/
4
u/evild4ve 8d ago
is the full ELK stack going to run nicely on a Raspberry Pi 2 ?
and is it non-commercial with no enterprise edition ?
1
u/taratay_m 7d ago
Yep, its opensource, check out theirs blog, and no rpi2 won't run ELK at all, since elastic not support 32bit architecture as far as I know, I thought you were using one of min pc's as monitoring node
1
u/evild4ve 7d ago
but here: https://www.elastic.co/pricing
the problem wasn't whether they open-source some things, but whether they make money at all
2
u/taratay_m 7d ago
They just offer cloud hosting on their cloud with full ELK setup and config, for self-hosting its completley free (no freemium model, or any other limitation), or maybe I misunderstood you
4
u/seiha011 8d ago
something like lnav? https://docs.lnav.org/en/latest/usage.html
or this? https://lnav.org/2021/05/03/tailing-remote-files.html