

I found graylog and the likes nice but as you said heavy on resources. I now have a central rsyslog server (on debian 12) that first does some filtering of log lines I don’t care about and then stores log in postgress. Grafana lives on that same host and I’m very happy with it. It performs quite well with just a fraction of resources graylog had as bare minimum. (The server has 4 sockets and 8Gb mem, storage to SSD while 4 firewalls, 3 switches, 4 AP’s and 20 servers logging to it) In the proxmox console I see 2Gb mem is used and the cpu is bored (<5%)
It’s not just them. I live in Sweden and I can’t understand why those from the middle east-area in the (men only) dressing room wrap themselves tightly i a towel and hide in the toilet to change clothes.