Launched a new instance and did not see the logs. Checking the dump showed that the logs are coming. I changed the tag to 7.5.10 for grafana and everything began to be displayed. The problem with the latest tagged container

First of thanks for taking the time to put this project together. I am sure I am missing something fairly obvious. I have a my device pointed to the IP of the VM where g-l-s-a is running and I am not seeing any data hitting being reflected in the dashboard.
my syslog-ng.conf file is as follows
axiom@ranch-a1:~/container/Grafana-Influxdb_2.x-Syslog-server/syslog$ cat syslog-ng.conf
@Version: 3.35
@include "scl.conf"

/etc/syslog-ng/syslog-ng.conf

source s_sys {
udp(ip(0.0.0.0) port(514));
};
destination telegraf_local {
syslog("telegraf" port(6514));
};
#filter f_default { level(info..emerg));
#};
log { source(s_sys); filter(f_default); destination(telegraf_local); };

any pointers would be greatly appreciated

Is there a reason the "New Alert" button does not show up after a fresh build. I cannot create alerts because of this.

Would like to know how to prevent the container for syslog-ng from filling up fast. Is it possible to logrotate it? thanks!

Good evening Lux4rd0,

First of all let me start off by saying that this stack you have put together here is really awesome out of the box. I have been messing around with this over the last week or so and it seems like all of my attempts to make custom dashboards have been failing. Every time I try to make changes, the either don't persist or just tell me that unique id already exists etc. I have tried making new dashboards from scratch but as soon as the stack restarts for whatever reason, the new dashboards do not seem to persist.

I am running this on docker and creating the stack using portainer. The only modifications I have made are changing the external directories from .config to something like /home/docker/syslog/.

I have tried changing the mounts on the grafana container to RW, and that doesn't seem to be solving my issue. Is there a way you could recommend for changes I need to make so that I can create customizable dashboards? I really like the dashboards you have included here but would like to mix/match some of the data they are all providing into a dashboard more tailored to my home environment. Again, love the work you have done with this :)

I am a super newbie when it comes to syslog-ng but I am here asking for help. I think what i need help with is understanding how I can modify the existing syslog-ng.conf -the default one provided by the stack - to have it receive from a truenas installation and also send logs to Splunk. I would appreciate any input, thanks

Rubber ducking this here:

 docker-compose -f ./docker-compose.yml up -d
[+] Running 1/8
 ⠴ loki Pulling                                                                                                5.6s
 ✘ cadvisor Error                                                                                              5.6s
 ⠴ minio Pulling                                                                                               5.6s
 ⠴ node-exporter Pulling                                                                                       5.6s
 ⠴ prometheus Pulling                                                                                          5.6s
 ⠴ promtail Pulling                                                                                            5.6s
 ⠴ syslog-ng Pulling                                                                                           5.6s
 ⠴ grafana Pulling                                                                                             5.6s
error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: 

Hi lux4rd0

First, thanks for such a great write up and example project. I've used your compose and config files to setup promtail and syslog-ng.

I have a 3 node docker swarm and this is working well for devices that send RFC 5424 messages, but I have an issue with RFC 3164. The hostname populated in the host label is an IP from the docker ingress network. In my case, 10.0.0.3. There is no way to differentiate between hosts as all RFC 3164 messages are recorded as 10.0.0.3 in Loki.

I have tested this with pfSense, it has an option to switch between RFC standards. When set to RFC 5424 the host value in Loki is correct.

Another example is Ubiquiti EdgeSwitchOS uses RFS 3164.

Do you know how to fix this so I can properly see the source host of the logs?

Hi - really like this project, thanks for your hard work.

I have an issue though - using the default docker-compose.yml, it spins up my stack great - however when I click the left panel in the grafana web ui, click the four small squares there is no browse option in the resulting menu that appears.

When I check the Amazon managed grafana dashboard at work (seperate to this project) which is on Grafana v8.4.0 it is there.

Example - this aio stack on version 8.1.2

As you can see there is no browse menu option when clicked.

Compared to my work Grafana on v 8.4.0

Do you know how to enable this option? Or is this just a case of we need a newer version of Grafana to enable this?

Thanks for your help :)

Mac OS: Version 11.6

I get the following error when run the command: docker-compose -f ./docker-compose.yml up -d

ERROR: for node-exporter Cannot start service node-exporter: path / is mounted on / but it is not a shared or slave mount

Rubber ducking here:

Possibly related to #8

docker-compose -f ./docker-compose.yml up -d
...
 ! syslog-ng The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm64/v8) and no specific platform was requested 0.0s
Error response from daemon: path / is mounted on / but it is not a shared or slave mount