Logging & Monitoring
Logging & Monitoring
This section covers centralized logging and security monitoring in the ProxLink homelab using Splunk.
Why Splunk?
Splunk is a platform for collecting, indexing, and searching machine data. In ProxLink it acts as the lab’s SIEM, providing:
- Centralized log collection from every component in the lab
- Search and correlation across firewall, DNS, VPN, and host logs
- Dashboards for visualizing network and security activity
- Alerts that trigger on suspicious events
Log Sources
| Source | Component | What is collected |
|---|---|---|
| Firewall | OPNsense | Firewall rule matches, blocked connections, system events (remote syslog) |
| DNS | Technitium DNS | Client queries, blocked domains |
| VPN | NetBird | Peer connections and access activity |
| Hosts | Ubuntu Desktop / Server VMs | System and authentication logs |