How to configure Grafana Alloy and Loki to ingest, normalize, and enrich OPNSense firewall logs

My first blog series on headscale with traefik through podman quadlets was pretty well received on here. I’m just getting started with this blog, and thought the second topic I recently worked on might be popular in this crowd too: a lower resource method of centralizing logs for OPNSense with Grafana Loki (and Alloy) including geoIP!

  • Lem453@lemmy.caEnglish
    2·
    18 hours ago

    Do you mind putting some screenshots of what the final dashboard looks like?

    Also, how much IO wear and tear does this put on a solid-state drive?

    • StarkZarn@infosec.pubOPEnglish
      2·
      13 hours ago

      I would love to if I had them! Haha. I’m working on the dashboard right now, which will be part two.

      I don’t have a great answer on the IOPS requirement, but I imagine it’s less than something based on elasticsearch/open search based on the reindexing. I’ll try and benchmark it if possible.