Incessant tinkerer since the 70’s. Staunch privacy advocate. SelfHoster. Musician of mediocre talent. https://soundcloud.com/hood-poet-608190196

  • 3 Posts
  • 64 Comments
Joined 3 months ago
cake
Cake day: March 24th, 2025

help-circle



  • I’m probably telling you wrong, but I’ve only been able to do the cs-blocklist-mirror and firewall-bouncer. There are a bunch of the scenarios that are remediation components. If you look at something like cs-cloudflare-worker-bouncer, well I don’t have a use for the cs-cloudflare-worker-bouncer remediation component, so that doesn’t get installed. Same for remediation components like cs-aws-waf-bouncer. So yes, there are unlimited remediation components, just not all will fit your use case. As I understand it, you can even write your own, tho I’ve not dabbled in that aspect.

    If all you want to do is look at Docker logs and the occasional syslog, then I would think Dozzle to be quite capable in conjunction with something along the lines of lnav.




  • On the free plan, you should be able to set up 2 remediation components, 4 blocklists, and a variety of scenarios. For the scenarios, I’d only install what you have need for.

    As far as logs, I personally think something more along the lines of Grafana+Loki+Alloy (Formerly Prometheus) for logs and metrics. You could even use something like lnav. Lnav is simple to install. It’s not a dialed out dashboard of metrics, rather it keeps things simple. After install, to access it simply type lnav and the log location you wish to view: lnav /var/log/auth.log or lnav /var/log/syslog in the cli. Don’t let it’s simplicity fool you tho. It is quite capable.

    I really tried with logging aps like ELK, Graylog, etc. I found them to be quite heavy for my environment. They certainly do have all the bells and whistles and pretty graphics, but again, it comes down to what can run on your server comfortably. I didn’t want to eat up 2/3 of my resources just to look at logs. The Grafana+Loki+Alloy combo really sips the resources. I think for all I have Grafana monitoring, it clocks in at around 2+/- gb in used resources.











  • But I know what the answer is and it’s not as exciting as I’d like it to be.

    At least you would know, and you would learn something new as I have done. I have set up to monitor syslogs, ufw logs, assorted metrics so far. I’m going to tackle using cAdvisor and ingest the data into Prometheus and display such data on my Grafana dash.

    It’s fun and educational. Try it. At the very least when you’ve worn all the new off, you can just delete the docker containers.




  • I have a follow up question about cadvisor, if you have a minute. Cadvisor employ Redis and Prometheus. If I understand correctly, you configure Prometheus to scrape Docker logs. All fine and good. However, my Grafana stack already employs Prometheus to do the same, just for syslogs and such, but not Docker. Can I not place the contents of the Cadvisor/Prometheus config in the existing Prometheus implementation used with Grafana, or does Cadvisor need it’s own Prometheus instance.