Fosstodon

0 posts0 participants0 posts today

Alejandro BaezI been messing around trying self hosted options for logs. Mostly to scratch an itch, but also to know what is available in the market.<a href="https://fosstodon.org/tags/openObserve" class="mention hashtag" rel="tag">#openObserve</a> is nice, but feels pretty clunky for what I want. Found this thing called <a href="https://fosstodon.org/tags/seq" class="mention hashtag" rel="tag">#seq</a>, which is kind of brilliant. But right now, I've settled with <a href="https://fosstodon.org/tags/victorialogs" class="mention hashtag" rel="tag">#victorialogs</a> from <a href="https://fosstodon.org/tags/victoriametrics" class="mention hashtag" rel="tag">#victoriametrics</a>. It can ingest <a href="https://fosstodon.org/tags/elasticsearch" class="mention hashtag" rel="tag">#elasticsearch</a> formatted logs. But you get the ease that <a href="https://fosstodon.org/tags/loki" class="mention hashtag" rel="tag">#loki</a> was trying to do. I have to say, I'm impressed. 😄<a href="https://docs.victoriametrics.com/victorialogs/logsql/" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://docs.victoriametrics.com/victorialogs/logsql/</a>

MalwareLabDuring the <a href="https://infosec.exchange/tags/SharkBytes" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SharkBytes</a> session at <a href="https://infosec.exchange/tags/SharkFest" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SharkFest</a> conference I had an opportunity to present a lightning talk about my pet project called IDS Lab. It is a lab infrastructure deployable as docker containers, which simulates the small company network.The IDS Lab consists of web webserver with <a href="https://infosec.exchange/tags/Wordpress" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Wordpress</a>, <a href="https://infosec.exchange/tags/MySQL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MySQL</a> database, <a href="https://infosec.exchange/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> desktop with RDP, the <a href="https://infosec.exchange/tags/WireGuard" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WireGuard</a> VPN for "remote" workers and for connecting another virtual or physical machines into the lab network. This part of infrastructure can be used for attack simulations.There are additional components for playing with logs and detections, too: <a href="https://infosec.exchange/tags/Fluentbit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fluentbit</a>, <a href="https://infosec.exchange/tags/Suricata" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Suricata</a> and <a href="https://infosec.exchange/tags/OpenObserve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenObserve</a> as lightweight SIEM. In the <a href="https://infosec.exchange/tags/SIEM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SIEM</a> we already have preconfgured dashboards for alerts, netflows, web logs and logs from windows machines, if present.Using the provided setup script, the whole lab can be up and running in up to 5 minutes. For more info, please check my GitHub repository with the IDS Lab:<a href="https://github.com/SecurityDungeon/ids-lab/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/SecurityDungeon/ids-lab/</a><a href="https://infosec.exchange/tags/sf24eu" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sf24eu</a> <a href="https://infosec.exchange/tags/wireshark" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#wireshark</a> <a href="https://ioc.exchange/@wireshark" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@wireshark</a>

farcallerLol. Their docs can't decide on the port they use. <a href="https://hdev.im/tags/openobserve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openobserve</a>

Özkan Pakdil 🦖Since morning I am searching for a nice free log analyzer, I used <a href="https://techhub.social/tags/splunk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#splunk</a> around 12 years just wanted to search quickly on some application logs, most probably log4j or log4net logs. I tried - <a href="https://techhub.social/tags/ELK" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ELK</a><-too hard to install configure - <a href="https://techhub.social/tags/graylog" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#graylog</a><-too complex or non working docs - <a href="https://techhub.social/tags/jaeger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#jaeger</a><-wanted json format - <a href="https://techhub.social/tags/openobserve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openobserve</a><-does not have simple log upload or file path provider, needs fluentd or kubectlI did not know splunk is this good, now I am convinced it is super product. Feel free to tell if you have a good suggestion and boost please for reach.

Andy BlylerI created an addon for <a href="https://hachyderm.io/tags/homeassistant" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#homeassistant</a> last night that allows you to ship logs from your <a href="https://hachyderm.io/tags/hassio" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hassio</a> instance to somewhere else via <a href="https://hachyderm.io/tags/fluentbit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fluentbit</a>: <a href="https://github.com/ablyler/ha-addon-fluent-bit" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/ablyler/ha-addon-fluent-bit</a>I am personally using this to send my logs to a local <a href="https://hachyderm.io/tags/openobserve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openobserve</a> instance: <a href="https://openobserve.ai" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://openobserve.ai</a>

atareao 🦀🐍🐋🐧577 - El cron lo carga el diablo Realizar copias de <a href="https://mastodon.social/tags/seguridad" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#seguridad</a> en <a href="https://mastodon.social/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> y <a href="https://mastodon.social/tags/Docker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Docker</a> utilizando <a href="https://mastodon.social/tags/cron" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cron</a> o <a href="https://mastodon.social/tags/systemd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#systemd</a> y como monitorizar la actividad con herramientas como <a href="https://mastodon.social/tags/OpenObserve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenObserve</a>El día que se me ocurrió la idea de levantar OpenObserve para controlar los contenedores Docker y otros procesos en mi VPS principal, me tenía que haber dado un premio. Con el paso del tiempo esta herramienta se ha convertido en una fuente increíble de reso <a href="https://mastodon.social/tags/atareaoConLinux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#atareaoConLinux</a> <a href="https://www.youtube.com/watch?v=vYJRmsWuGGc" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.youtube.com/watch?v=vYJRmsWuGGc</a>

Peter CzanikThe February <a href="https://fosstodon.org/tags/syslog_ng" class="mention hashtag" rel="tag">#syslog_ng</a> newsletter is now available:- <a href="https://fosstodon.org/tags/OpenObserve" class="mention hashtag" rel="tag">#OpenObserve</a> <a href="https://fosstodon.org/tags/JSON" class="mention hashtag" rel="tag">#JSON</a> API support- Syslog-ng PE can now send logs to <a href="https://fosstodon.org/tags/Google" class="mention hashtag" rel="tag">#Google</a> <a href="https://fosstodon.org/tags/BigQuery" class="mention hashtag" rel="tag">#BigQuery</a>- syslog-ng can now do a full configuration check- How build services make life easier for upstream developers<a href="https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-insider-2024-02-openobserve-configuration-check-build-services" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-insider-2024-02-openobserve-configuration-check-build-services</a>

ItzTrainI remember someone mentioning <a href="https://hachyderm.io/tags/OpenObserve" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenObserve</a> here sometime ago and decided to give it a go in the <a href="https://hachyderm.io/tags/homelab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#homelab</a> it's a binary which is easy enough to get going. Documentation is garbage tho. It was easy enough to start ingesting logs and it uses an OTEL collector which I guess is in the spirit and all that.

Peter CzanikThe December syslog-ng newsletter is now out:- Compressing HTTP traffic- Why is a feature not available in the <a href="https://fosstodon.org/tags/syslog_ng" class="mention hashtag" rel="tag">#syslog_ng</a> package?- Sending logs to <a href="https://fosstodon.org/tags/OpenObserve" class="mention hashtag" rel="tag">#OpenObserve</a>- Removing duplicate messages with syslog-ng in a redundant logging environment<a href="https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-insider-2023-12-compressed-http-packages-openobserve-duplicates" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://www.syslog-ng.com/community/b/blog/posts/the-syslog-ng-insider-2023-12-compressed-http-packages-openobserve-duplicates</a>

Peter CzanikVersion 4.5.0 of syslog-ng is now available with <a href="https://fosstodon.org/tags/OpenObserve" class="mention hashtag" rel="tag">#OpenObserve</a> JSON API support:<a href="https://www.syslog-ng.com/community/b/blog/posts/version-4-5-0-of-syslog-ng-is-now-available-with-openobserve-json-api-support" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://www.syslog-ng.com/community/b/blog/posts/version-4-5-0-of-syslog-ng-is-now-available-with-openobserve-json-api-support</a><a href="https://fosstodon.org/tags/LogManagement" class="mention hashtag" rel="tag">#LogManagement</a>

Peter CzanikVersion 4.5.0 of <a href="https://fosstodon.org/tags/syslog_ng" class="mention hashtag" rel="tag">#syslog_ng</a> is now available with <a href="https://fosstodon.org/tags/OpenObserve" class="mention hashtag" rel="tag">#OpenObserve</a> <a href="https://fosstodon.org/tags/JSON" class="mention hashtag" rel="tag">#JSON</a> API support, and many other smaller features. My blog shows you how to get up-to-date installers, and a sample syslog-ng configuration for OpenObserve.<a href="https://www.syslog-ng.com/community/b/blog/posts/version-4-5-0-of-syslog-ng-is-now-available-with-openobserve-json-api-support" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://www.syslog-ng.com/community/b/blog/posts/version-4-5-0-of-syslog-ng-is-now-available-with-openobserve-json-api-support</a><a href="https://fosstodon.org/tags/LogManagement" class="mention hashtag" rel="tag">#LogManagement</a>

Peter Czanik<a href="https://fosstodon.org/tags/OpenObserve" class="mention hashtag" rel="tag">#OpenObserve</a> has an <a href="https://fosstodon.org/tags/Elasticsearch" class="mention hashtag" rel="tag">#Elasticsearch</a> compatible API for log ingestion, but syslog-ng is not mentioned in the documentation. Luckily, as it turned out, OpenObserve has a ready to use <a href="https://fosstodon.org/tags/syslog_ng" class="mention hashtag" rel="tag">#syslog_ng</a> configuration example in the web UI.<a href="https://www.syslog-ng.com/community/b/blog/posts/sending-logs-to-openobserve-using-syslog-ng" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://www.syslog-ng.com/community/b/blog/posts/sending-logs-to-openobserve-using-syslog-ng</a><a href="https://fosstodon.org/tags/LogManagement" class="mention hashtag" rel="tag">#LogManagement</a>

Recent searches

Search options

Administered by:

Server stats:

#OpenObserve