Solution for storing and searching logs from hardware devices

Ask Fedora
1

Hello! We operate small community network. Most of our devices use Ubiquity devices, but we have also Mikrotik wireless access points and some managed switches.

Is there any solution in Fedora, which would receive logs by old fashioned BSD syslog format over UDP and process it into some frontend?

I have already configured syslog to accept logs over network. We do not need any authentication or TLS, because those devices usually do not support any of them.

I hoped I would find some web frontend for working with such logs. Displaying recent messages of chosen severity, maybe filtered by hostname. But I have failed to find any open source solution with minimal requirements. I expected very simple frontend to text logs, running in nginx or apache at our log server. We want something simple to maintain.

SSH is great, but not always easiest to use outside or from the roof. Is there something we have prepared in Fedora? I hoped some systemd-journald system could help with working with those logs. But it seems journald cannot receive network logs from old protocol in a simple way. I expect there are a lot of simple devices without support for something more advanced, this should be relatively common.

rsyslog.conf to receive network:
input(type=“imudp” port=“514”)

Have I missed some good solution for it? Can you give me tips on some projects? Ideally packages on Fedora or CentOS.

2

here is the quick tldr and please make sure to verify the packages but these are the ones I use

dnf install rsyslog rsyslog-mysql mariadb-server httpd php php-mysqlnd
systemctl enable --now rsyslog mariadb httpd

make sure to edit the rsyslog.conf and then add

module(load="imudp")
input(type="imudp" port="514")

and make sure you restart rsyslog systemctl restart rsyslog

if you need more filtering, which is what i recommend, you’re going to want to set up your SQL database unless you want a file-only instance of the filtering

If you’re skipping the SQL, you’re going to want to install LogAnalyzer and run the setup wizard, and then make sure you set up your firewall and test it.

Hope this helps

3

I ended with syslog-ng for the moment. It has a bit better configuration syntax. Allowed simple redirection of network received events into file separate from local messages log. But I hoped there would be at least very minimalistic web log viewer with basic search support. Something I would not have to hack myself.

I do not need to keep logs for long, support for logrotate is desired. With text logs that part is simple.