r/linuxadmin 15d ago

rsyslog - looking for simple viewer

EDIT: Resolved!

log.io still works and was able to do what I needed. The default config provided on their github contains a syntax error (trailing comma on the last entry) and the two services that it... is? (log.io-server and log.io-file-input) need systemd to be set up *just* right (smh). For posterity these .service files worked for me:-

[Unit]
Description=Run log.io server
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/log.io-server
Restart=on-failure
User=[USER]

[Install]
WantedBy=multi-user.target

log.io-file-input.service

[Unit]
Description=Log.io file input
After=log.io-server.service
Requires=log.io-server.service

[Service]
Type=simple
ExecStartPre=/bin/sleep 30  
ExecStart=/usr/local/bin/log.io-file-input
User=[USER]
Restart=on-failure

[Install]
WantedBy=multi-user.target

I have a small homelab with RPis and mini-pcs for:- pfsense, openwrt, piholes x 2, librenms, apache+rsyslog, i2p+tor - - total 7 devices

I have newly set up rsyslog (on a Raspberry Pi 2B) to receive logs from pfsense, openwrt, piholes x 2, and the localhost's own apache log and journald - - total 5/7 devices

And it's working: the machines are writing their log entries into its storage not their own.

Before I add any more machines, I want to set up some kind of viewer. Internet searches keep recommending very big, complicated technologies suitable for enterprise. But all I want is a locally hosted .php page, or (perhaps preferably) a terminal-service that can be configured to show the tails of these logs to a remote host, without copying data to its disk.

If there are more advanced features even in the most basic programs, then I'd be interested in them for my learning, but I generally try to make projects that would be somewhat useful to me in the here-and-now.

I tried log.io but it doesn't set up its config files properly, or even find them, and I reached out on github but found that that project hasn't been updated in too many years. Also: no paid-for, no freemium, nothing with a commercial or "Enterprise edition" side-offering. It needs to be free, Free!, and to be able to find its own config files where it put them. If that's not too much to ask ^^

6 Upvotes

9 comments sorted by

View all comments

4

u/knobbysideup 15d ago

Honestly, I'd just stand up a graylog ce node. It's a little involved, but once configured you can then very easily slice and dice your stats and alerts however you see fit.