Bash nginx + system monitor. TUI dashboard, read-only web UI with SSE live-tail, log tailing, heuristic scanner/exploit detection, multi-destination alerts (Discord / Slack / Telegram / Matrix), headless daemon, historical metrics with σ-based anomaly detection, host-integrity audits (FIM / persistence / ports / YARA / accounts / rootkit), and an optional eBPF probe sidecar that streams kernel events (exec / tcp / file / ptrace / kmod / retransmit / syscall-rate / bpf-load) through the same alert pipeline.
The shipping artifact is still a single file (milog.sh → /usr/local/bin/milog),
but it's built from modular source under src/ by
build.sh. Users install one file; contributors edit small ones.
Everything in-depth lives under docs/ — skim the
docs index or jump straight in:
- Configuration — variables, env overrides, nginx
log_format - Alerts — Discord / Slack / Telegram / Matrix setup, rule catalog, history
- Host integrity audits —
milog audit(fim / rootkit / persistence / ports / accounts / yara), provocations to verify detection - Web dashboard —
milog web, systemd user service, SSH / Tailscale / Cloudflare Tunnel exposure patterns - Historical metrics — SQLite time series,
trend/diff/auto-tune milog daemon— headless mode, systemd service, permissions- Kernel observability (
milog probe) — eBPF sidecar, the 8 probes,install-service, allowlist tuning - GeoIP enrichment — MaxMind license + weekly auto-refresh
- Troubleshooting —
milog doctor+ common failure modes
Plus: ARCHITECTURE.md for contributors and SERVER_HARDENING.md for pairing milog with real server hardening.
Linux, bash 4+, coreutils, ps, df, uptime, read access to
/var/log/nginx/*.access.log. Everything else (gawk, curl, sqlite3,
optionally mmdblookup, plus the milog-web / milog-tui Go binaries)
is handled by install.sh.
GitHub Releases ship .deb, .rpm, and .apk packages alongside the
tarballs. Pulls in bash + coreutils + curl + gawk automatically
through your distro's package manager:
# Debian / Ubuntu
curl -fsSL -o milog.deb https://github.com/chud-lori/milog/releases/latest/download/milog_<VER>_linux_amd64.deb
sudo apt install ./milog.deb
# Fedora / Rocky / RHEL
curl -fsSL -o milog.rpm https://github.com/chud-lori/milog/releases/latest/download/milog_<VER>_linux_amd64.rpm
sudo dnf install ./milog.rpm
# Alpine
curl -fsSL -o milog.apk https://github.com/chud-lori/milog/releases/latest/download/milog_<VER>_linux_amd64.apk
sudo apk add --allow-untrusted ./milog.apkReplace <VER> with the latest release tag
(or omit the version and use the unversioned latest redirect manually).
The packages drop milog, milog-web, and milog-tui into /usr/bin,
plus shell completions and docs under /usr/share.
Drops milog + Go binaries into /usr/local/bin; uses your distro's
package manager to ensure gawk / curl / sqlite3 are present:
curl -fsSL https://raw.githubusercontent.com/chud-lori/milog/main/install.sh | sudo bashOpt-in extras:
# GeoIP enrichment (adds mmdblookup; also needs a MaxMind MMDB later)
curl -fsSL https://raw.githubusercontent.com/chud-lori/milog/main/install.sh \
| sudo bash -s -- --with-geoipThe web dashboard ships as the milog-web Go binary — install.sh
fetches it from the latest GitHub release alongside milog itself, so
no separate flag and no system listener (socat / ncat) is needed.
Installer auto-detects and uses the local milog.sh:
git clone https://github.com/chud-lori/milog.git /opt/milog
cd /opt/milog
sudo ./install.sh
sudo ./install.sh --uninstall # keeps ~/.config/milog/, ~/.cache/milog/Verify: milog help. Then milog doctor — checks every optional
capability (sqlite3, geoip, webhook, log format, systemd units) and
prints a one-line fix for each degraded piece.
milog monitor # bash dashboard — CPU/MEM/DISK + per-app nginx table
milog tui # richer Charm TUI (same data; needs milog-tui Go binary)
# q quit p pause r refresh ? help ↑/↓ select enter drill esc back
# Turn on Discord alerts in one command (installs systemd service too)
sudo milog alert on 'https://discord.com/api/webhooks/YOUR_ID/YOUR_TOKEN'
milog alert status
milog alert test
# Turn on historical metrics so trend / diff / auto-tune have data
milog config set HISTORY_ENABLED 1
sudo systemctl restart milog.service
# Investigate a suspicious IP
milog attacker 13.86.116.180
# What fired overnight?
milog alerts 24h
# Linux only — install the eBPF probe sidecar (exec / file / net / ptrace
# / kmod / retransmit / syscall-rate / bpf-load watchers fire through the
# same alert pipeline)
sudo milog probe install-service
sudo journalctl -u milog-probe.service -fFull command list: milog help.
milog # merged color-prefixed tail of all apps
milog monitor # bash dashboard (refresh-and-redraw, POSIX-everywhere)
milog tui # Charm Bubble Tea TUI (richer panels, help footer, same data)
milog rate # nginx-only req/min dashboard
milog daemon # headless — fire alerts, no TUI
milog health # 2xx/3xx/4xx/5xx totals per app
milog top [N] # top N source IPs
milog top-paths [N] # top N URLs: req / 4xx / 5xx / p95 per path
milog slow [N] # slowest endpoints by p95
milog stats <app> # hourly request histogram
milog suspects [N] [W] # heuristic bot ranking
milog attacker <IP> # forensic view: one IP, all apps
milog search <pat> [flags] # grep across current + archived logs
milog trend [app] [H] # sparkline from history
milog diff # per-app: now vs 1d / 7d ago
milog auto-tune [D] # suggest thresholds from history
milog replay <file> # postmortem for one archived log
milog alerts [window] # local fire history
milog errors # live 4xx/5xx tail
milog exploits # LFI / RCE / SQLi / XSS / infra-probe live tail
milog probes # scanner/bot traffic live tail
milog grep <app> <pattern>
milog <app> # raw tail of one app
milog web [install-service|stop|status]
milog probe [status|install-service|uninstall-service] # Linux only — eBPF sidecar
milog alert [on|off|status|test]
milog audit [fim|persistence|ports|yara|accounts|rootkit] [baseline|check|status]
milog silence <rule_or_glob> <duration> [msg]
milog config [init|add|rm|dir|set|edit]
milog doctor # diagnostic checklist
milog help
| Key | Action |
|---|---|
q |
quit |
p |
pause (freezes sparklines) |
r |
refresh now |
+ / - |
decrease / increase rate |
milog tui uses a context-aware footer and ? help pane, so the
available keys stay visible as you move between overview, drill-down,
alerts, paths, errors, and trend views. Use ↑/↓ or k/j to move
the overview cursor, enter/l/→ to drill into an app, and
esc/h/←/backspace to return. In focused views, ↑/↓ or k/j
scroll, f/page-down and b/page-up page through longer output, and
r reloads the current view.
sudo rm /usr/local/bin/milog
sudo rm -f /etc/systemd/system/milog.service
rm -f ~/.config/systemd/user/milog-web.service
rm -rf ~/.config/milog ~/.cache/milog ~/.local/share/milog
sudo rm -rf /opt/milog # if clonedOr via the installer: sudo ./install.sh --uninstall (keeps config +
state dirs so re-installing preserves your settings).
The shipping artifact milog.sh is generated from src/*.sh by
build.sh. Don't edit milog.sh by hand — edit the file under src/
that owns the code, then run bash build.sh to regenerate the bundle.
Commit both the source change and the regenerated milog.sh.
See src/README.md for the source layout and
ARCHITECTURE.md for design internals.