Logging

Graylog + OpenSearch

Centralized log aggregation split across two VMs: a Graylog main node and a dedicated OpenSearch data node storing logs on a separate disk. All hosts forward syslog via rsyslog.

Graylog and its OpenSearch data node form the centralized logging stack, every host forwards its syslog output here via rsyslog, giving one searchable place to investigate anything.

See Graylog in Self-Hosted Applications for more details.