How to build Grafana + Loki Logging Server for NxFilter.

[support200]

If you have several thousand users or more, you may need a separate logging/reporting server as it can place a heavy load on NxFilter. There are many specialized tools for logging/reporting, and we will show you how to use one of them that is Grafana, with NxFilter.

We suppose you already have Ubuntu 22.04 (or later) and Docker running.

1. Download nxfilter-grafana.zip attached and extract it on your Ubuntu server.
You will have 3 files in nxfilter-grafana directory:
- docker-compose.yml
- alloy-config.alloy
- dashboard.json

2. In the nxfilter-grafana directory, start the stack.

cd nxfilter-grafana
docker compose up -d

3. Open Grafana
- URL: http://<your-server-ip>:3000
- ID: admin / PW: admin123

4. Add Loki data source
- Connections > Data sources > Loki
- URL: http://loki:3100
- Save & test

5. Import dashboard
- Dashboards > New > Import
- Upload dashboard.json

6. On NxFilter GUI, go to System > Setup > Syslog
- Syslog Host: <your logging server IP>
- Syslog Port: 514
- Use JSON Format: checked
- Enable Remote Logging: checked

7. Restart NxFilter.
Your dashboard will start populating.

- After creating your logging/reporting server with Grafana, you can completely bypass logging on the NxFilter traffic DB. To do this, set Log Retention Days on System > Setup to 0.

- When you don't see any log data on Grafana, check if packets are arriving at your logging server.

sudo tcpdump -i any udp port 514 -n