Every log source gets a dashboard of its own.
EasyLog collects syslog from your web servers, firewalls and WAFs, parses each source by type into an embedded DuckDB store, and turns it into live dashboards you can click straight through to the raw lines. One binary, and nothing leaves your network.
Nine log types. A dashboard built for each.
A web log asks how fast and how often. A firewall log asks what was denied. A WAF log asks what got through anyway. Each family gets the layout that answers its own question.
Requests, latency, status codes
Requests over time, error rate and bytes served, average and p95 request duration where the proxy logs it, and the top URLs, clients and countries behind them.
What was denied, and from where
A deny rate and the allow/deny split, top sources, destinations and ports, the rule that decided, and the application wherever PAN-OS identifies one.
What the policy let through
Six verdicts stacked over time, a Served anyway count for requests an enforcing policy would have refused, the split per appliance and site, and the rules that fired.
Raw lines, kept and searchable
For a device EasyLog has no parser for: every line stored exactly as it arrived, with volume over time, the top senders, hostnames and tags, and full-text search.
From a spike on the timeline to the lines that caused it.
Every panel is a filter. Click a bar, a status class, a country or a client and the whole dashboard follows, and the raw log lines behind it are one button away.
Click to filter
Every URL, client, status class, rule and country is a link. Filters stack as removable chips and live in the URL, so any view can be shared.
Zoom into a period
Click the 2am bar and the page is pinned to 02:00–03:00, re-bucketed into five-minute bars. Keep clicking and you reach a single minute.
Raw lines, one click away
The Raw button swaps the charts for the log lines behind them, under the same filters. Page through them, or download every matching line.
Search every field
One box across URLs, clients, agents, rules, ports and applications. It narrows the KPIs, the charts and the map together.
Offline world map
Client addresses are resolved to countries at ingest, from a database bundled in the binary. No lookup ever leaves the machine.
Bounded storage
Set a retention window and old events are pruned every hour. The database is compacted at startup to hand the disk back.
One binary between your devices and your dashboards
Devices send syslog the way they already can. EasyLog routes each message by the address it came from, parses it by type, and stores it as rows in DuckDB. Every dashboard is a live query over them.
Running in minutes. Upgraded like everything else.
EasyLog installs from the signed EasySYS package repository, starts on boot under systemd, and upgrades through the package manager you already use. The installation guide has the details.
Start with one source.
Point a single web server or firewall at EasyLog and watch its dashboard fill up. MIT licensed and developed in the open.