Build Docker-Based Graylog Log Server to Monitor OpenVPN Logins (Rocky Linux 9, rsyslog)
Budget: $15 – $25 USD
We are seeking a skilled engineer to set up a Dockerized Graylog log server on a Rocky Linux 9 VM. This log server will help us monitor OpenVPN activity and determine whether users are connecting from corporate-issued laptops — or potentially using their OpenVPN client profiles on unauthorized personal devices.
We already collect VPN logs via rsyslog, and we want to forward those logs to this secondary log server for correlation and dashboarding. You’ll be provided with a static device registry (spreadsheet or CSV) that maps corporate laptop hostnames and MAC addresses — no live database integration is required.
⸻
Environment:
• OS: Rocky Linux 9
• Available resources: 1 dedicated VM with 2TB disk
• OpenVPN servers: ~6, already shipping logs using rsyslog
• Deployment method: Docker Compose
⸻
Scope of Work:
1. Graylog Stack Deployment (inside Docker):
• Graylog 6.x
• MongoDB
• OpenSearch
• Optional: GeoIP Resolver or HTTPS reverse proxy (Nginx)
2. Syslog Input Setup:
• Configure Graylog to accept rsyslog logs (UDP 514)
• Ensure tags distinguish between different VPN servers
3. Pipeline Processing Rules:
• Extract key fields: username, certificate CN, MAC address, source IP
• Compare MAC or hostname fields against our static device registry
• Flag logins from unknown/untrusted devices
• Detect unusual behavior (e.g., cert reuse across multiple usernames)
4. Dashboards / Searches:
• Show top users by connection count
• Identify untrusted or unknown devices
• Visualize connections by location (GeoIP)
• Highlight unusual reuse of certs or CNs
5. Reporting & Comparison (Optional):
• We already have a daily shell-scripted report that emails user + MAC address info.
• You don’t need to replace this — just enable Graylog search or export to complement this existing report.
• It’s likely we’re both pulling from the same logs anyway, so this is just for parity/comparison.
6. Storage and Persistence:
• Mount volumes under /storage for config and log data
• All components must survive container or host reboot
We already collect VPN logs via rsyslog, and we want to forward those logs to this secondary log server for correlation and dashboarding. You’ll be provided with a static device registry (spreadsheet or CSV) that maps corporate laptop hostnames and MAC addresses — no live database integration is required.
⸻
Environment:
• OS: Rocky Linux 9
• Available resources: 1 dedicated VM with 2TB disk
• OpenVPN servers: ~6, already shipping logs using rsyslog
• Deployment method: Docker Compose
⸻
Scope of Work:
1. Graylog Stack Deployment (inside Docker):
• Graylog 6.x
• MongoDB
• OpenSearch
• Optional: GeoIP Resolver or HTTPS reverse proxy (Nginx)
2. Syslog Input Setup:
• Configure Graylog to accept rsyslog logs (UDP 514)
• Ensure tags distinguish between different VPN servers
3. Pipeline Processing Rules:
• Extract key fields: username, certificate CN, MAC address, source IP
• Compare MAC or hostname fields against our static device registry
• Flag logins from unknown/untrusted devices
• Detect unusual behavior (e.g., cert reuse across multiple usernames)
4. Dashboards / Searches:
• Show top users by connection count
• Identify untrusted or unknown devices
• Visualize connections by location (GeoIP)
• Highlight unusual reuse of certs or CNs
5. Reporting & Comparison (Optional):
• We already have a daily shell-scripted report that emails user + MAC address info.
• You don’t need to replace this — just enable Graylog search or export to complement this existing report.
• It’s likely we’re both pulling from the same logs anyway, so this is just for parity/comparison.
6. Storage and Persistence:
• Mount volumes under /storage for config and log data
• All components must survive container or host reboot
Related categories:
Python
System Admin
Linux
Amazon Web Services
Network Administration
Elasticsearch
Docker
OpenVPN
MongoDB
Graylog