← Directory

loglook

Small read-only viewer and API for the syslog files Unraid's built-in syslog server collects (syslog-IP.log and its rotated copies).

  • Infrastructure
  • Monitoring & Logging
  • Network Services
  • Tools & Utilities
Small read-only viewer and API for the syslog files Unraid's built-in syslog server collects (syslog-IP.log and its rotated copies). Pick a device and a time window and loglook finds the lines by their own timestamps across the live and rotated files, so you never open a multi-gigabyte file by hand. Three views of any window: the lines, top patterns (MACs, IPs and numbers collapsed so repeats become one row with a count) and counts per captured value. Filters take plain text or a regex, and a window can end earlier to compare today with previous days. A read-only JSON API behind bearer tokens serves the same queries to scripts and automations such as n8n. Tokens are created in the web UI, shown once, and stored hashed. Setup: set Syslog Folder to your Unraid syslog share (Settings, Syslog Server, Local syslog folder). Open the web UI, create the admin user, then open Sources: every

Platform availability

Available on 1 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

39/100 Low

Maintained
72last commit 0 days ago
Popular
00 GitHub stars
Easy to install
201 install platform, Docker image
Light to run
No data

Based on 3 of 4 factors.

Availability: platform listings confirmed today

GitHub stars
0
Open issues
0
Last commit
2026-10-23
Latest release
2026.10.22d
License
MIT
Activity
rising

Checked today - source: GitHub (ccmpbll/loglook)

Resources & Compatibility

ARM (e.g. Raspberry Pi) is supported.

Checked today - source: Docker Hub image tags and published docs

First-install notes

No first-install notes yet.

Alternatives

No alternatives collected yet.

Common questions

Which volumes should I mount when running loglook in Docker?

Mount the Unraid syslog share read-only to /logs, plus writable /config and /data folders. The README uses /mnt/user/syslog:/logs:ro, ./config:/config, and ./data:/data.

What should I set if I expose the web UI through a reverse proxy?

Serve loglook over HTTPS behind the reverse proxy. Also set LOGLOOK_SECURE_COOKIES=true.

How does loglook treat syslog lines that do not include a time zone?

It reads them as local time using the timezone chosen on the Sources page. The default is America/New_York, and the year is inferred.

How are API tokens handled for scripts and automations?

Tokens are created in the web UI, shown once, and only a hash is stored. Send them to the read-only JSON API as Authorization: Bearer <token>.

Can I edit sources.yml by hand, and what happens if I make it invalid?

Yes, plain YAML changes are picked up, but saving from the Sources page rewrites the file and loses comments. If an edit stops parsing, the last good configuration stays in use and changes are paused until the file is fixed or deleted.

Answers sourced from github.com

Community

No community discussions collected yet.