graylog¶
| Field | Value |
|---|---|
| VMID | 109 |
| Type | LXC |
| Role | Central syslog (Pattern E) |
| Status | Active (running) |
| Host | prox |
| OS | Debian |
| vCPU / RAM | 2 / 8 GB |
| Disk | 30 GB (rootfs) |
| IP | 192.168.6.197 |
| Graylog | 6.1.11 |
Overview¶
Central syslog for network gear and unmanaged hosts. All planned senders verified 2026-06-26 (including HAOS via syslog add-on). SIEM is Wazuh on infra-services; container logs stay on Loki.
Runbooks¶
- Central syslog (Graylog) — sender matrix, rollout, verification
- Wazuh SIEM — do not duplicate managed-Linux syslog here