MiLog

Why MiLog?

Most server-monitor tooling assumes either a team or a SaaS budget. MiLog assumes one operator, one or three boxes, and a Discord channel.

Single-file bash

One milog.sh drops into /usr/local/bin. No daemons-on-daemons, no Python venv, no Node, no Docker.

▲

Alerts that don't spam

Per-rule cooldown, cross-rule dedup keyed on (ip, path). Discord, Slack, Telegram, Matrix — all behind the same rule catalog.

Same-minute-of-day anomaly

Compares each minute against the same minute over the last 14 days. Absorbs the daily traffic curve so you don't page on the 9am rush.

⌬

eBPF probe sidecar

Optional Linux-only Go binary. Streams kernel events — exec, tcp, file, ptrace, kmod, retransmit, syscall-rate, bpf-load — through the same alert pipeline.

⎔

Host integrity audits

FIM, persistence, ports, YARA scans, accounts, rootkit checks. Baselines once, diffs every tick.

⌖

Built for forensics

milog attacker <ip>, milog replay, archived-log search, hourly top-IP rollup — the postmortem tooling is first-class, not bolted on.

What it watches

One process, six surfaces. Everything fires through the same alert pipeline with cooldown and dedup.

nginx access logs

Per-app req/min sparklines
4xx / 5xx spike alerts (configurable thresholds)
p50 / p95 / p99 latency tracking
Top paths, top IPs, slowest endpoints

System /proc

CPU / MEM / disk / nginx-workers thresholds
POSIX-only — no sar, iostat, etc.

Exploit patterns heuristic

LFI / RCE / SQLi / XSS in URLs
Infra probes (.git, .env, wp-admin, phpMyAdmin, …)
CMS scans, dotfile probes

Scanner bots UA catalog

zgrab, masscan, nikto, sqlmap
Shodan, CensysInspect, generic HTTP libs
AI crawlers (GPTBot, Claude-Web, …)

Host integrity audit

FIM — /etc + binaries + cron + ~/.ssh
Persistence — services, timers, MOTD, rc.local
Ports — listening sockets diff
YARA — webshells, common malware families
Accounts — UID 0, sudoers, new users
Rootkit — preload, hidden PIDs, modules

Kernel events eBPF · Linux

exec — process spawns matching allowlist
tcp — outbound connect to non-allowlisted CIDRs
file — writes to /etc, binaries, etc.
ptrace, kmod, bpf-load
Retransmit + syscall-rate (Welford σ)

Install

Native packages on Debian/Ubuntu, Fedora/RHEL, Alpine. Or the universal curl one-liner.

Drop the binary

curl -fsSL https://raw.githubusercontent.com/chud-lori/milog/main/install.sh \
  | sudo bash

Installs milog + the milog-tui and milog-web Go binaries from the latest release. Ensures gawk / curl / sqlite3 via your distro's package manager.

Live dashboard

milog monitor          # bash dashboard, refresh-and-redraw
milog tui              # richer Charm TUI, help footer, same data

The Charm TUI keeps active keys in the footer, opens full help with ?, and scrolls longer alert/path/error/trend output in focused views so navigation stays predictable.

Turn on Discord alerts

sudo milog alert on 'https://discord.com/api/webhooks/ID/TOKEN'
milog alert status
milog alert test

Installs the systemd unit, enables it, fires a test embed. Slack / Telegram / Matrix work the same way — see docs/alerts.md.

Bank history for anomaly detection

milog config set HISTORY_ENABLED 1
sudo systemctl restart milog.service
# ...wait 14 days, then:
milog config set ANOMALY_ENABLED 1
milog auto-tune 7      # calibrate thresholds from history

Optional: eBPF probe sidecar — Linux only

sudo milog probe install-service
sudo journalctl -u milog-probe.service -f

Streams kernel events through the same Discord / Slack / Telegram webhook config, with the same cooldown + dedup. See docs/probe.md.

Design rules

Bash stays bash. If POSIX bash + gawk can do it well, it stays in bash. Go is for what bash genuinely can't reach (eBPF, raw tracepoints, real TUIs with contextual key help and scrollable focused views).
One artifact per install. Ship a bundled milog.sh from modular src/*.sh. Users install one file; contributors edit small ones.
Cooldown + dedup are non-negotiable. Every rule has a cooldown key. Cross-rule dedup on (ip, path). The day a scanner shows up shouldn't be the day your Discord channel breaks.
Hard gates over heuristics. Anomaly detection has three independent silence gates (MIN_DAYS, per-metric floor, stddev > 0). Better to under-alert during ramp-up than cry wolf.
No black boxes. Every decision the daemon makes goes to stderr — fired, suppressed-by-cooldown, dedup-collapsed. journalctl -u milog.service -f tells the whole story.

Watch your nginx box,
not your dashboards.