Logs¶
The Log Browser lets administrators inspect all important system logs directly from the panel — no SSH access required. A second tab on the same page configures log forwarding to a SIEM.
Requirements¶
- Admin access to the WebPanel
- NetCell Agent active on the target server
Access¶
Menu → SECURITY → Logs — the page has two tabs: Browser and Log Forwarding.
Tab: Browser¶
Supported Log Sources¶
Web Server¶
| Name | Source |
|---|---|
| Nginx – Access | /var/log/nginx/access.log |
| Nginx – Errors | /var/log/nginx/error.log |
| Nginx – ModSecurity | /var/log/nginx/modsec_audit.log |
System¶
| Name | Source |
|---|---|
| System Log | /var/log/syslog |
| Authentication | /var/log/auth.log |
Mail¶
| Name | Source |
|---|---|
| Mail (Postfix) | journald – postfix@-.service |
| Dovecot | journald – dovecot.service |
| rspamd | journald – rspamd.service |
| Roundcube | /var/log/roundcube/errors.log |
Security¶
| Name | Source |
|---|---|
| Fail2ban | journald – fail2ban.service |
Panel¶
| Name | Source |
|---|---|
| ProFTPD | journald – proftpd.service |
| WebPanel | journald – enconf-webpanel.service |
Filters & Options¶
| Option | Description |
|---|---|
| Server | Multi-server only: select the target server |
| Log Type | Select source from the grouped dropdown |
| Lines | Number of recent lines to retrieve (1–2000, default: 200) |
| Filter | Free-text search (case-insensitive) |
| Level | Filter by severity: Error / Warning / Info / Debug |
Level Detection¶
Severity levels are automatically detected from the log line content:
| Level | Colour | Detection patterns |
|---|---|---|
| Error | Red | error, crit, emerg, alert, [error] |
| Warning | Yellow | warn, [warn] |
| Debug | Grey | debug, [debug] |
| Info | White | everything else |
Live Mode¶
The Live Mode toggle (top right) refreshes the log view automatically every 30 seconds. Ideal for real-time monitoring of ongoing operations.
Download¶
The Download button saves all currently displayed (and filtered) entries as a .log file to your browser.
Multi-Server¶
When multiple servers are registered, a server selector appears above the filter bar. Logs are always fetched from the selected server.
Tab: Log Forwarding (SIEM)¶
Ship the security-relevant logs of every server to a central collector (a SIEM or log server) over TLS. Off-host logging is a compliance cornerstone: a host that is compromised later can no longer erase the evidence it already shipped.
The configuration is fleet-wide — it is pushed to every active server and re-applied automatically at controller start, so it survives reboots and reaches servers that were briefly unreachable.
TLS is mandatory¶
There is no plaintext option. When you enable forwarding you must provide:
- a collector host and port (default
6514, syslog-over-TLS / RFC 5425), and - the CA certificate (PEM) that signs the collector's certificate.
The agent configures rsyslog with the GnuTLS network driver and verifies the
collector's certificate against your CA (x509/certvalid). If you also set a
Permitted peer, the collector's certificate name (CN/SAN) must match it
exactly (x509/name, name pinning).
The forwarding action uses an on-disk spool (queue.saveonshutdown,
maxdiskspace=256m, infinite resume-retry), so a brief collector outage or a
burst never drops messages.
Sources¶
All security-relevant sources are on by default. You can narrow the set:
| Source | What it forwards |
|---|---|
| Auth / SSH | auth, authpriv — sshd, sudo, PAM (logins, privilege use) |
| Nginx | /var/log/nginx/access.log + error.log (via imfile) |
Postfix + Dovecot (mail facility) |
|
| fail2ban | Ban/unban events |
| Panel audit | The enconf-* services' journal (API + agent) |
| Journal | Everything else the journal carries (daemon, cron, kernel) |
When Journal is on, everything is forwarded in one action (auth, mail, fail2ban-via-journal and the panel services are already included), and the per-facility filters are omitted to avoid shipping a message twice. Turn Journal off to forward only the individually selected facilities.
Applying & status¶
Saving validates the whole rsyslog configuration (rsyslogd -N1) on each server
before restarting rsyslog and rolls back the drop-in if validation fails —
so a bad value can never leave rsyslog unable to start. The per-server
distribution panel shows, for each active server, whether the config was
applied or why it failed (e.g. an unreachable agent).
Test connection performs a live TLS probe from every server to the collector — it opens the connection, verifies the certificate against your CA and (if set) the permitted-peer name, and reports the collector's certificate CN. Use it to confirm the collector is reachable and trusted before saving, instead of letting rsyslog silently spool undeliverable messages.
A server added later automatically receives the current forwarding config as part of its onboarding, so a new node starts shipping its logs immediately (no controller restart required).
The agent installs rsyslog + rsyslog-gnutls on demand (Debian 13 ships
journald-only by default).
Files written on the server¶
| Path | Contents |
|---|---|
/etc/rsyslog.d/00-enconf-forward.conf |
The forwarding ruleset + source routing |
/etc/rsyslog.d/enconf-forward-ca.pem |
Your collector CA bundle (root-only) |
Disabling forwarding removes both files and restarts rsyslog.