The dependable pattern is rsyslog on each Linux host → Telegraf’s syslog input → InfluxDB → Grafana. Telegraf receives and parses the stream, InfluxDB stores timestamped records, and Grafana turns those records into searchable log rows and dashboards. This guide shows how to build that path securely, model fields without creating an unmanageable database, test each hop, and decide when Loki is a better fit.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
How the centralized logging stack works
Every source machine keeps its normal local logging and forwards selected messages to the VPS. The VPS acts as the collection and visualization point:
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsLinux host A (rsyslog) ─┐
Linux host B (rsyslog) ─┼─> Telegraf syslog listener ─> InfluxDB ─> Grafana
Linux host C (rsyslog) ─┘rsyslog decides which facilities and severities to send and formats messages for transport. Telegraf listens on the central port, parses syslog fields, and writes points through an InfluxDB output plugin. InfluxDB supplies retention and time-range queries. Grafana connects to InfluxDB and displays the result as log rows, tables, alerts, or mixed dashboards.
This design is especially sensible when the VPS already runs Telegraf and InfluxDB for metrics. You reuse an agent, an output path, credentials, retention controls, and Grafana access instead of operating a separate log platform. It is not automatically the best choice for very high-volume, full-text log search; the Loki comparison later addresses that trade-off.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Decide the scope before opening a port
Choose what to collect
Start with a defined set of facilities and severities rather than forwarding every message from every daemon. Authentication events, kernel messages, service errors, and reverse-proxy access logs often provide more value than routine debug output. A narrow first policy makes bandwidth, storage, and query behavior predictable; you can add another facility after verifying ingestion.
Keep management interfaces private
Expose only the syslog listener to the source hosts. Keep Grafana’s web interface and InfluxDB’s API bound to a private address, VPN, firewall allow-list, or an authenticated reverse proxy. On the VPS firewall, permit the chosen syslog port only from the source machines’ addresses. Never make InfluxDB’s write API broadly reachable just because Telegraf needs it locally.
Recommended Free Tools
Pick transport deliberately
Telegraf’s syslog input supports Unix-domain sockets, UDP, TCP, and TLS. TCP uses port 6514 by default when no port is specified in the listener address. UDP is simple and low overhead but can lose datagrams during congestion. TCP provides a connection and back-pressure; TLS adds confidentiality and server authentication for traffic crossing an untrusted network. Use TLS when hosts and the VPS communicate over the public internet or another network you do not control.
Step 1: Prepare the Linux VPS
Install the three services
Install InfluxDB, Telegraf, and Grafana using the packages and repository instructions for the VPS distribution and version. The exact package names and repository setup differ between distributions and between InfluxDB releases, so do not copy a command intended for another operating system. Enable each service under systemd after installation, but configure Telegraf only after you know the InfluxDB organization, bucket (InfluxDB 2.x), or database (InfluxDB 1.x) that will hold the logs.
Reserve a log bucket or database
Create a dedicated destination such as a logs bucket or database rather than mixing log points into a metrics measurement. A separate destination makes retention changes safer and lets you grant Telegraf write access without giving it unnecessary access to unrelated data. Record the InfluxDB URL, organization, bucket, and write token for 2.x, or the URL, database, username, and password for a 1.x-compatible output.
Plan the network rule
Choose one listener address and document it before editing clients. For example, a TCP listener on 6514 might be reachable only from 10.20.0.0/24. Allow that source range in the VPS firewall, deny other inbound traffic to the port, and verify that the VPS security group or provider firewall has the same rule. Keep Grafana and InfluxDB administration on SSH, a private interface, or a VPN.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Step 2: Configure Telegraf as the collector
Telegraf requires both sides of the pipeline: at least one input plugin to collect data and one output plugin to write it. A syslog input without an InfluxDB output will accept messages but has nowhere to send them; an output without an input has nothing to write.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
TCP listener with InfluxDB 2.x output
Place a dedicated file under Telegraf’s configuration directory, for example /etc/telegraf/telegraf.d/syslog.conf:
[[inputs.syslog]]
server = "tcp://:6514"
[[outputs.influxdb_v2]]
urls = ["http://127.0.0.1:8086"]
token = "$INFLUX_TOKEN"
organization = "example-org"
bucket = "logs"The listener address is an example; replace the bind address, organization, and bucket with your values. If InfluxDB is on another host, use its private URL and apply firewall rules to that connection as well.
InfluxDB 1.x-compatible output
For an InfluxDB deployment using databases rather than organizations and buckets, use the corresponding output plugin and fields:
[[outputs.influxdb]]
urls = ["http://127.0.0.1:8086"]
database = "logs"
username = "$INFLUX_USER"
password = "$INFLUX_PASSWORD"Use one InfluxDB output style, not both, unless you intentionally need to duplicate the stream.
Keep secrets out of the file
Telegraf’s guide recommends environment variables or a secret store instead of embedding credentials in plain configuration. Ensure the systemd service receives INFLUX_TOKEN (or the username and password variables) through a protected environment file or your operating system’s secret mechanism. Restrict that file so ordinary users cannot read it, and do not paste tokens into support tickets or shell history.
Enable TLS when required
Telegraf’s syslog service plugin supports TLS. Configure the listener with the TLS transport and provide the server certificate and private key according to the plugin options for your Telegraf version. Install the issuing CA on each rsyslog sender, use a certificate name that matches the collector address, and test certificate validation before switching every host. A TLS listener that is configured without a matching rsyslog TLS client will fail at the handshake stage, so keep a temporary TCP test path available during migration only if your security policy permits it.
Validate the configuration before restarting
Run Telegraf’s configuration test command for the installed version, then restart the service and inspect its journal:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo telegraf --test --config /etc/telegraf/telegraf.conf
sudo systemctl restart telegraf
sudo systemctl status telegraf
sudo journalctl -u telegraf -fThe test should report a readable configuration and loaded input/output plugins. A successful restart proves syntax, not end-to-end ingestion; you still need to send a known message from a source host and query InfluxDB.
Step 3: Forward messages from each Linux source
Forward selected messages over TCP
Create a small rsyslog drop-in such as /etc/rsyslog.d/60-central-logs.conf on each source. This example forwards all messages in RFC5424-compatible format over TCP:
*.* @@logs.example.net:6514;RSYSLOG_SyslogProtocol23FormatIn rsyslog syntax, a single @ denotes UDP and double @@ denotes TCP. Replace the hostname with the VPS address and, in production, use a rule that matches your collection policy instead of automatically exporting every facility. For example, an authentication-focused rule can forward authpriv.*; a warning-and-higher rule can forward *.warning while excluding facilities you do not need.
Use UDP only when its loss profile is acceptable
The Grafana Syslog dashboard example uses a classic UDP/514 listener for incoming rsyslog traffic and forwards RFC5424-formatted messages to Telegraf on TCP/6514. You can use UDP from a source to the VPS if occasional loss is acceptable and the network is controlled, but do not assume that a UDP send confirms storage. A sender can transmit a datagram even when the collector is stopped or the packet is dropped.
Free tools Windows power users keep installed
One-click scans. No signup required.
Reload rsyslog and generate a test event
sudo rsyslogd -N1
sudo systemctl restart rsyslog
logger -p local0.notice "central-log test from $(hostname)"rsyslogd -N1 checks configuration syntax. After the restart, the logger command creates a distinctive event that is easy to find in Grafana. If you use a facility or severity filter, make the test message match that filter.
Secure the source-to-VPS path
For TLS, configure rsyslog’s forwarding action with its TLS stream-driver settings, trusted CA, and certificate-name validation, then point it at Telegraf’s TLS listener. The exact directives depend on the rsyslog version and certificate layout. Do not treat “TLS enabled” as complete until you verify both certificate validation and that a message appears in InfluxDB. Restrict the VPS firewall to the source IPs even when TLS is enabled; encryption does not replace access control.
Step 4: Model syslog data for useful queries
Preserve the information a responder needs, but avoid turning every changing value into an indexed dimension. A practical record contains these fields when the incoming message supplies them:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
| Attribute | Recommended role | Why it matters |
|---|---|---|
| Timestamp | Time field | Required for time-range queries and Grafana log rendering. |
| Message text | Field | Contains the human-readable event; keeping it as a tag creates excessive cardinality. |
| Host | Stable tag or label | Allows filtering by machine without indexing every message. |
| Application name | Tag when bounded | Separates sshd, nginx, a database, and other known services. |
| Facility | Tag or field | Supports the same routing vocabulary used by rsyslog. |
| Severity/level | Tag or field | Enables error and warning filters. |
| Message ID | Field or bounded tag | Useful for structured RFC5424 events when present. |
The exact measurement and field names depend on your Telegraf parser and output version. Inspect a recent point before writing a permanent dashboard query. Keep high-cardinality values—request IDs, user IDs, complete URLs, stack traces, and raw message text—as fields. A tag set that grows with every event can make indexes large and queries slower.
Handle timestamps and clocks
Grafana’s log view needs a real timestamp. Ensure source hosts use a functioning time-synchronization service and that the collector preserves the event time rather than replacing it with ingestion time. Clock drift can place an event outside the time range you selected and make cross-host incident timelines misleading.
Step 5: Connect Grafana to InfluxDB
Add the data source
- In Grafana, open Connections and choose Data sources.
- Select Add data source, choose InfluxDB, and select the query language that matches your InfluxDB setup.
- Enter the private InfluxDB URL. For InfluxDB 2.x, provide the organization, bucket, and token; for a 1.x-compatible setup, provide the database and its credentials.
- Click Save & test. Resolve URL, authentication, or network errors before building a panel.
Grafana treats a data source as the connection to the system that stores metrics or logs. InfluxDB is supported as a data-source plugin, so the same connection can be used in Explore and dashboards.
Inspect events in Explore
Open Explore, select the InfluxDB data source, set a narrow time range around the test event, and query the measurement that contains your records. With InfluxQL, a typical shape is:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →SELECT "message", "level", "host"
FROM "syslog"
WHERE $timeFilter
ORDER BY time DESCReplace syslog and the column names with those shown by your data. In Flux or SQL mode, build the equivalent query with a time filter and the message column. Grafana’s InfluxDB editor expects a timestamp and a message column for log output; level and host add context. Format the result as Logs rather than as a time-series chart when you want one row per event.
Create a Logs panel
- Create or open a dashboard and choose Add visualization.
- Select the InfluxDB data source and reuse the verified Explore query.
- Set the visualization to Logs, map the timestamp and message fields, and expose host, application, facility, or level as additional fields.
- Save the dashboard with a time range appropriate to your retention period.
Keep the initial dashboard simple: a log stream, a host filter, a severity filter, and a time picker. Add counts or panels for error rates only after you have confirmed that parsing and field names are stable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 6: Operate and verify the pipeline
Check each hop in order
- Source:
journalctlor local log files contain the event, and rsyslog has no configuration error. - Network: the VPS firewall permits the source address and the selected port; Telegraf is listening on that address.
- Collector:
journalctl -u telegrafshows accepted messages rather than parse, authentication, or output errors. - Storage: a query against the expected bucket or database returns a recent point.
- Grafana: the data source test succeeds and the Logs panel uses the correct timestamp and message columns.
On the VPS, ss -ltnp can confirm a TCP listener, while the Telegraf journal is the authoritative place to look for parser and write failures. Test with a known time window and a unique token in the message so an old event cannot be mistaken for the new one.
Set retention intentionally
Retention must match disk capacity, event volume, and how far back you investigate incidents. The available sources do not establish a universal CPU, RAM, disk, or retention number; those values are workload-specific. Start with a measured window, watch disk usage and write errors, and shorten or lengthen retention based on actual ingestion rather than a generic VPS size recommendation.
Back up what is valuable
Decide whether logs are merely short-term operational context or an audit record. If they are evidence for compliance or incident response, plan backups or export before the retention window expires. Grafana dashboards and Telegraf configuration should be version-controlled separately from the log data; never rely on a dashboard as a backup of the underlying events.
Troubleshoot the failures you are most likely to see
Grafana shows no rows
- Widen the time range and search for the unique
loggertest string. - Confirm the source rule matches the facility and severity used by the test.
- Check that Telegraf is listening on the expected protocol and port and that the firewall allows the source IP.
- Query InfluxDB directly or through Grafana Explore to distinguish a storage problem from a panel query problem.
- Verify that the panel uses the actual measurement, timestamp column, and message field names.
Messages arrive but fields are empty
Inspect the raw format arriving at Telegraf. A parser configured for RFC5424 may not extract fields from an unexpected legacy format, and a sender using a different framing mode can produce malformed records. Align the rsyslog template, Telegraf transport, and framing settings, then send a fresh test event.
Only some hosts appear
Compare the working and failing hosts’ destination address, protocol, firewall source rule, DNS resolution, and rsyslog status. A UDP sender can appear healthy while packets are discarded; test TCP or TLS from the failing host and watch the collector journal during the test.
TLS handshakes fail
Check certificate expiry, the trusted CA, the certificate name used by the client, private-key permissions, and whether both ends use the same framing and protocol. Temporarily increase logging only for diagnosis, then remove verbose settings after the handshake succeeds.
InfluxDB becomes difficult to query
Look for unbounded tags such as complete message text, request IDs, or URLs. Move those values to fields, retain only bounded dimensions such as host and severity, and review the retention window. This field/tag split is more important as the number of hosts and events grows.
InfluxDB or Loki for centralized logs?
Both can feed Grafana, but they optimize for different operating models. InfluxDB is a time-series database that can store the parsed log records described above. Loki is a log-focused system built around labels: an agent such as Alloy gathers logs, Loki stores them, and Grafana queries and visualizes them. Loki does not index the full contents of every log line like a traditional full-text engine; labels determine the streams, while content is scanned during queries.
| Decision factor | InfluxDB path | Loki path |
|---|---|---|
| Existing stack | Strong fit when Telegraf and InfluxDB already run for metrics. | Requires a Loki-oriented collector and storage path. |
| Ingestion in this design | rsyslog → Telegraf syslog input → InfluxDB. | Typically an agent gathers logs and pushes them to Loki. |
| Query model | InfluxQL, Flux, or SQL depending on version; timestamp and message columns are mapped in Grafana. | Label-based streams with log-content filtering during queries. |
| Labels and cardinality | Use bounded tags and keep changing text in fields. | Use a small, stable label set; excessive labels also create too many streams. |
| Retention | Controlled through the InfluxDB bucket or database policy and disk capacity. | Controlled through Loki’s storage and retention configuration. |
| Best match | Modest log volume, structured fields, and a desire to reuse the metrics stack. | Log-first operations, larger log workloads, and a label-oriented search workflow. |
| Operational complexity | One database and agent if those are already established. | Additional log-specific components, storage, and lifecycle settings. |
Choose InfluxDB when integration with an existing Telegraf/InfluxDB deployment outweighs the need for specialized log storage. Choose Loki when log volume, retention, and log-centric querying are the primary requirements and you are prepared to operate its label and storage model. Compare expected volume, retention duration, query patterns, label cardinality, transport security, and the team’s operational familiarity before migrating.
Quick Recap
A repeatable rollout plan
- Install and secure InfluxDB, Telegraf, and Grafana on the VPS; keep management endpoints private.
- Create a dedicated logs bucket or database and a least-privilege Telegraf credential.
- Enable one Telegraf syslog input and one matching InfluxDB output; validate the configuration.
- Allow the listener port only from source addresses and select TCP or TLS for untrusted networks.
- Forward one facility from one Linux host and send a unique
loggertest event. - Verify the event in Telegraf’s journal and InfluxDB before adding more hosts.
- Add the InfluxDB data source in Grafana, confirm a timestamp and message column, and format the result as Logs.
- Expand source rules gradually, monitor ingestion and disk use, and set retention from measured workload behavior.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
