loglook loglook syslog log viewer unraid syslog server read-only api tokens n8n ccmpbll/loglook:latest https://hub.docker.com/r/ccmpbll/loglook bridge sh false https://github.com/ccmpbll/loglook/issues https://github.com/ccmpbll/loglook https://github.com/ccmpbll/loglook/blob/main/README.md Small read-only viewer and API for the syslog files Unraid's built-in syslog server collects (syslog-IP.log and its rotated copies). Pick a device and a time window and loglook finds the lines by their own timestamps across the live and rotated files, so you never open a multi-gigabyte file by hand. Three views of any window: the lines, top patterns (MACs, IPs and numbers collapsed so repeats become one row with a count) and counts per captured value. Filters take plain text or a regex, and a window can end earlier to compare today with previous days. A read-only JSON API behind bearer tokens serves the same queries to scripts and automations such as n8n. Tokens are created in the web UI, shown once, and stored hashed. Setup: set Syslog Folder to your Unraid syslog share (Settings, Syslog Server, Local syslog folder). Open the web UI, create the admin user, then open Sources: every device that has written a log appears with a Name it box, and the timezone is set on the same page. Nothing to write by hand. The log folder is mounted read-only and nothing in it is ever changed. Web interface: http://UNRAID_IP:8000 Tools:Utilities Network:Management http://[IP]:[PORT:8000] https://raw.githubusercontent.com/ccmpbll/unraid-docker-templates/refs/heads/master/templates/loglook.xml https://raw.githubusercontent.com/ccmpbll/unraid-docker-templates/refs/heads/master/images/loglook.png ###2026-10-22 - Update for loglook 2026.10.22d: the viewer's filter box is two even rows with Contains full width below, one column on phones - Update for loglook 2026.10.22c: every viewer filter is always visible, the window list goes down to 5 minutes, Sources rows are edited in place, and the loglook icon is the favicon - Update for loglook 2026.10.22b: devices and the timezone are set on the Sources page, so there is no sources.yml to write; the Config folder must be writable - Update for loglook 2026.10.22a: fixes from a code review (an empty just-rotated file, a device with a fast clock, files holding more than a year, the query time budget is checked on every line) - Initial template for loglook 2026.10.22 8000 /mnt/user/syslog /mnt/user/appdata/loglook/config /mnt/user/appdata/loglook/data