graylog¶
| Field | Value |
|---|---|
| VMID | 109 |
| Type | LXC |
| Role | Central syslog (Pattern E) |
| Status | Active (running) |
| Host | prox |
| OS | Debian |
| vCPU / RAM | 2 / 8 GB |
| Disk | 50 GB (rootfs; grown 2026-08-03) |
| IP | 192.168.6.197 |
| Graylog | 6.1.11 |
Overview¶
Central syslog for network gear and unmanaged hosts. All planned senders verified 2026-06-26 (including HAOS via syslog add-on). Wazuh was removed. Container logs stay on Loki.
Access¶
| Method | Target |
|---|---|
| Web UI | https://graylog.infra.realemail.app (Traefik + Authentik on infra-services) |
| Direct LAN (debug) | http://192.168.6.197:9000 |
| Syslog input | UDP 192.168.6.197:514 |
http_external_uri on the LXC is set to the HTTPS URL so UI/API links work
behind Traefik. Journal max size is 2 GB (message_journal_max_size).
Runbooks¶
- Central syslog (Graylog) — sender matrix, rollout, verification
- Wazuh SIEM (retired)