PlaybookWhere to host it: local PC, VMware VM, standalone server or AWS?
safe beginner #hosting#vmware#aws#ubuntu#local pc#standalone
When to use this: You know the software, but need to decide where the syslog server should physically run.
| Option | Good for | Pros | Cons | Cost shape |
|---|---|---|---|---|
| Your own PC (Windows or macOS app, or a VM) | Lab, learning, demos | Zero setup cost, easy to experiment | Sleeps, reboots, changes IP; not reliable | Free |
| VMware VM (Workstation or ESXi) | Home lab, SMB with a hypervisor | Snapshots, easy resize, can sit on the LAN | Needs a host that stays on; depends on host health | Free software if you already have the host |
| Standalone Ubuntu server or mini PC | Small office, permanent setup | Simple, independent, cheap to run | Hardware to maintain, disk failures | One-off hardware and electricity |
| AWS EC2 (or other cloud) | Remote sites, no on-prem hardware | Always on, easy scaling, snapshots | Monthly cost, exposure risk, needs VPN or TLS | Pay per hour plus storage |
| Appliance (FortiAnalyzer, SIEM appliance) | Larger or vendor-supported estates | Support, tuned for the vendor | Licence cost | Quote-based |
Rules that apply to every option
- Always on, with a static IP (or a DHCP reservation).
- Reachable from every sender on the right port (see the ports scenario).
- Disk sized for volume times retention (see the sizing scenario).
- Time synchronised (see the time scenario).
- Backed up, or at least snapshotted, before big changes.
How to verify it worked
- The chosen host stays on, has a fixed IP, is reachable from every sender and has enough disk.
Common errors and fixes
Server on a laptop that sleeps or moves networks Logs are lost whenever it is off or has a new IP. Use an always-on VM or small server with a static IP.
Running the server inside WSL2 on Windows and the firewall cannot reach it WSL2 normally sits behind its own NAT, so devices on the LAN cannot see it. Use a real VM with a bridged adapter, or WSL's mirrored networking mode if your Windows version supports it.
Q&A
Can the syslog server run on my own PC?
Yes for a lab or learning. For anything real, no: sleep, updates, reboots and DHCP address changes all cause gaps.
Do I need a physical server?
No. A small VM is enough for most small and medium setups. A mini PC with Ubuntu is a cheap physical alternative.
Is cloud (AWS) a good idea for logs from an office firewall?
It can be, if you protect the path (VPN or TLS and strict source allow-listing) and accept a monthly cost. The advantage is that it stays up independent of your office.