Claude Code – Syslog Security Dashboard

It’s been exhausting to have access to Claude Code. There’s so much more you can achieve with it. In this situation I had a licensed syslog product which was coming to End of Life. I understood how syslog worked and what we required of a syslog dashboard. So I took the time to specify it in CLAUDE.md in particular local conventions for naming and preferences and got Claude to work. I’d say this was actually 4 days worth of Clauding. I will list some issues I had.

Syslog Dashboard

The program will filter by date, host, string search, severity. It will all be visualized over chosen timelines and it’s clickable to help you home in on the peaks.

Example Detail Page

So on a basic level it has done very well. I can push syslog events to it easily, and see them. Actually it was on a Rocky Linux 10 host and crowdstrike was restarting and coredumping so, it helped straight away to highlight that.

I had Claude to create me some check scripts for nagio, making use of the complete API it has created. It picks out hosts which are creating high severity alerts above a stated threshold – that kind of thing.

Claude was pretty sure there was contention for the database causing the system to crash every 6 minutes. I had let it use Sqlite and it improved that and finally I agreed it would try mariadb which would not have such issues. Of course, it still crashed. I needed a break and then intuition pointed at the systemd templates – there was a timeout value of 6 minutes so it was inappropriately configured. Still, we got a mariadb set up which would be better in the long run.

I don’t think it was expert with Nagios configurations so I should have just written this bit of the documentation myself. It would give alot of detail on a small point. Anyway. In the end I passed it anonymised templates.

I’d say it was great at programming, testing, checking, but made mistakes or oversights with gunicorn, systemd, nagios. These are neglected areas lets say. But, I wouldn’t complain. It’s output is immense. It’s facility for updating documentation just superb.