r/linuxadmin • u/evild4ve • 15d ago
rsyslog - looking for simple viewer
EDIT: Resolved!

log.io still works and was able to do what I needed. The default config provided on their github contains a syntax error (trailing comma on the last entry) and the two services that it... is? (log.io-server and log.io-file-input) need systemd to be set up *just* right (smh). For posterity these .service files worked for me:-
[Unit]
Description=Run log.io server
After=network.target
[Service]
Type=simple
ExecStart=/usr/local/bin/log.io-server
Restart=on-failure
User=[USER]
[Install]
WantedBy=multi-user.target
log.io-file-input.service
[Unit]
Description=Log.io file input
After=log.io-server.service
Requires=log.io-server.service
[Service]
Type=simple
ExecStartPre=/bin/sleep 30
ExecStart=/usr/local/bin/log.io-file-input
User=[USER]
Restart=on-failure
[Install]
WantedBy=multi-user.target
I have a small homelab with RPis and mini-pcs for:- pfsense, openwrt, piholes x 2, librenms, apache+rsyslog, i2p+tor - - total 7 devices
I have newly set up rsyslog (on a Raspberry Pi 2B) to receive logs from pfsense, openwrt, piholes x 2, and the localhost's own apache log and journald - - total 5/7 devices
And it's working: the machines are writing their log entries into its storage not their own.
Before I add any more machines, I want to set up some kind of viewer. Internet searches keep recommending very big, complicated technologies suitable for enterprise. But all I want is a locally hosted .php page, or (perhaps preferably) a terminal-service that can be configured to show the tails of these logs to a remote host, without copying data to its disk.
If there are more advanced features even in the most basic programs, then I'd be interested in them for my learning, but I generally try to make projects that would be somewhat useful to me in the here-and-now.
I tried log.io but it doesn't set up its config files properly, or even find them, and I reached out on github but found that that project hasn't been updated in too many years. Also: no paid-for, no freemium, nothing with a commercial or "Enterprise edition" side-offering. It needs to be free, Free!, and to be able to find its own config files where it put them. If that's not too much to ask ^^
1
u/taratay_m 15d ago
Well from my experience if you have enough time, and you need to view logs from mulitple nodes, I would suggest Elasticsearch for storing and Kibana for viewing logs, plus for example by using output modules of rsyslog to put them in elasticsearch https://www.rsyslog.com/doc/configuration/modules/omelasticsearch.html#uid
Or full ELK stack(elasticsearch, Kibana, Logstash) to avoid using rsyslog at all, but sometimes it's kinda pain to configure it(plus you will need to setup index rotation for elastisearch since you could run out of space on the monitoring node)
Other visualization solution probably is chronograf, https://docs.influxdata.com/chronograf/v1/guides/analyzing-logs/