Debian 12 on mine. Why?
What do you use for log aggregation on sub-$10 boxes?
pablo said:
How do you pick which 6?
The ones with customer data. The ones with egress. The ones that touch money. Everything else is cattle.
hadestiger said:
Debian 12
Rsyslog with imfile for application logs, tls to central. Or systemd-journal-remote if you hate yourself slightly less. Debian 12 has both in main, no third party repos needed.
airgapped, encrypted, faraday'd, still worried
pablo said:
How do you pick which 6?
I picked the 6 that cost me money when they break. The other 46 are... educational. I learn what happens when you ignore a box for 90 days.
olespete said:
Systemd-journal-remote
Tried it. The binary journal format is great until you need to grep across 6 months. Then you miss plain text. Rsyslog to central, compress with zstd, grep like it's 1999.
seedbox, NAS, tape, and three offsite
techmei
Member
olespete said:
TLS on syslog or don't bother
Or WireGuard mesh between all 52 and the collector. Same certs problem, but one tunnel, one IP allowlist. I do this for my cheap boxes in Contabo Singapore and Contabo Mumbai. Latency to central is fine for logs.
Contabo charges same EUR price everywhere by the way. Mumbai or Munich, same 4 euro.
minhdock
Member
I use Loki with Docker on 2GB Contabo in Singapore. It run okay if I set --limit-memory=512m and use filesystem storage not boltdb. But I only have 8 box not 52. 52 is too many for Loki I think.
annexbi
Member
pablo said:
Contabo boxes are in EUR
Yes and the VAT is fun depending on where you pretend to live (or actually live) (I actually live in Oslo so I pay the fun Norwegian VAT) (still cheaper than anything local) (Norway is expensive) (everything is expensive) (except salmon) (salmon is reasonable)
Anyway for 52 boxes have you considered (he said, considering) that you don't need aggregation at all? You need alerting. Different thing. Aggregate metrics, alert on anomalies, log on demand. Prometheus node_exporter is lighter than any log shipper.
push. done. coffee.