Logging & Monitoring

System Logging

Component	Description
rsyslog	Traditional syslog daemon
systemd-journald	Structured logging (binary journal)
journalctl	Query interface for journald

Logrotate

Logrotate is configured for the following services:

/etc/logrotate.d/alternatives
/etc/logrotate.d/apport
/etc/logrotate.d/apt
/etc/logrotate.d/bootlog
/etc/logrotate.d/btmp
/etc/logrotate.d/cloud-init
/etc/logrotate.d/dpkg
/etc/logrotate.d/fail2ban
/etc/logrotate.d/postgresql-common
/etc/logrotate.d/rsyslog

sysstat

sysstat is enabled for historical performance data. Collection runs every 10 minutes:

• sysstat-collect.timer — runs every 10 minutes
• sysstat-summary.timer — runs daily summary at 00:07

Kernel Messages

The following workqueue CPU-hogging warnings have been observed (non-critical):

Workqueue	Times Hogged
wait_rcu_exp_gp	1024
vmstat_shepherd	256+
psi_avgs_work	128
vmstat_update	256+
page_reporting_process	64
Various others	4–32

Recent Errors (Last 24h)

Severity	Source	Message
ERR	sshd	Brute-force from 212.0.217.14 (root + admin)
ERR	sshd	Connection reset by peer (multiple)
WARN	systemd	Caddy reload failed (twice)
WARN	kernel	Various workqueue CPU hogging warnings

Docker Logging

• Docker uses json-file logging driver
• Container logs are available via docker logs <container>
• No centralized log aggregation (Prometheus/Loki/Grafana) is currently deployed

Recommendations

• Consider deploying a log aggregation stack (Loki + Grafana or similar)
• Investigate workqueue CPU warnings — may indicate need for kernel tuning or host-level fix
• Set up alerting for SSH brute-force patterns