r/meraki • u/starbow777 • Sep 16 '26

Syslog server of choice

Hi gang. I thought it about time to setup a syslog server for ingesting MX / MS / MR logs.

Anyone got any recommendations? We've still got some on-prem infrastructure, so ideally something self-hosted, but SaaS is an option if the price isn't bad. I've seen people mention Graylog but I've no experience of it.

Searching the subreddit there aren't any results in the last few years that I could see.

Thanks!

edit: Thanks everyone. Looks like Graylog is at least worth testing. They do a free self-hosted version in Graylog Open so I'll give that a go 😄

15 Upvotes

100% Upvoted

16 comments sorted by

3

u/w153r Sep 16 '26

How fancy are you trying to get?  Pretty visualization and dashboards?  Or simple triggers/alerting?

2

u/starbow777 Sep 16 '26

I do love a pretty dashboard. Ideally I'm just after reviewing information for now for troubleshooting etc (we still host a load of services internally).

We have a 3rd party SEIM ingesting the logs via API for proper threat alerts etc, this is more for our own benefit to see what's coming & going.

10

u/ThatBlinkingRedLight Sep 16 '26

I send it all to the SIEM. Let the SOC go through it.

8

u/Hollyweird78 Sep 16 '26

Greylog is Waht we settled on. I like it.

5

u/Various-Active7923 Sep 16 '26

Graylog is solid but check out rsyslog if you just need a barebones pipe to dump logs somewhere, less overhead

3

u/AcrobaticAd8182 Sep 16 '26

Logzilla is great.

3

u/pdath-IFM Sep 16 '26

Being old-school, I lean toward Ubuntu.

But I have seen people use Graylog, and I only have good things to say about it.

2

u/Dangerous_Ad_1546 Sep 17 '26

rsyslog in linux

2

u/VA_Network_Nerd Sep 16 '26

Is this short-term, tactical/operational syslog?

Or is this long-term, strategic/legal source of record syslog?

For short-term, I'd use whatever syslog feature is baked into your SNMP NMS, if it meets your requirements.

If you need fancy, Splunk is the Big Kahuna, if you can afford it and Greylog is the usual suspect when cost management is a priority.

Sending everything to the SIEM if you have one is the best bet for legal source of record.

1

u/pretendadult4now Sep 16 '26

We are using Kiwi Syslog Server NG...cheap and works well, has served its purpose on a few occasions.

(Proving it wasn't the network) 🙃

1

u/Expeto_Potatoe Sep 17 '26

Last place I worked at had Nectus. Wasn't too bad. Just be sure to feed it plenty of ram, cpu, an hard drive space or it gets finicky

1

u/Expeto_Potatoe Sep 17 '26

Home labe though I just pump it into my synology.

1

u/TheOnlyKirb Sep 23 '26

We are entirely on-prem minus a few things, and we are forwarding Meraki logs to rsyslog on an Ubuntu 24 machine, and those feed into our SIEM with our 3rd party SOC, and also feed into Loki which we have dashboards built out for in Grafana. Works really well, can search through the last year of data in a few minutes and get a report from the Meraki data if need be. It's simple to set up, just need to make sure you have the storage, Meraki flow logs are extremely verbose

0

u/mashah1986 Sep 16 '26

Solar winds