acouvreur / ssh-log-to-influx

Send SSH authentication logs to influxdb with geohashing IP

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

No data

suruaku opened this issue · comments

commented

Hi, I installed this repo using docker-compose.standalone.yml and I have rsyslog running and the config you provided.

On my :3000 I had to log in to grafana and from the output of docker I saw that it was authenticating me to router at my home I don't know why? (the IP it used to sent /login is my Modem Router at home) but admin/admin worked and I created a new password.

I found the correct dashboard but it does not have any data. When I try to test Data Sources / InfluxDB with default URL http://influxdb:8086 I get and error database not found: telegraf

Also I am not able to modify the IP of InfluxDB because of this message This datasource was added by config and cannot be modified using the UI. Please contact your server admin to update this datasource.

I'd really appreciate it if you're able to help.

Hi,
you can change the influxdb configuration here https://github.com/acouvreur/ssh-log-to-influx/blob/master/grafana/provisioning/datasources/influxdb.yml

You have to change the rsyslog configuration on your system that expose the ssh port see https://github.com/acouvreur/ssh-log-to-influx#rsyslog-configuration

And there will be no data until an attempt, to do this you can try to connect via ssh to your server and watch the logs under /var/log/auth.log and then docker logs the tcp server to see if you correctly forward auth failures