---
title: "Remote Logging"
slug: "application-security-remote-logging"
updated: 2025-08-27T01:22:17Z
published: 2025-08-27T01:22:17Z
canonical: "docs.fmad.io/application-security-remote-logging"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fmad.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Remote Logging

In many cases the FMADIO system sits at the edge of the network. Where the device is primairly a decode analysis edge device that sends the processed data to a central location. Example configuration is shown below.

![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/SecurityRemoteLogging.drawio.png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A48%3A22Z&se=2026-11-13T19%3A48%3A22Z&sr=c&sp=r&sig=aYNZkXmNkTLh5xMYrkMDQZeefXqmysVR8DpbtUeaAcA%3D)

In the above example there are 3 FAMDIO devices processing the raw captured data, sending the logs to a single Security LXC instance where the database and Grafana are located.

This can be setup easily using the following configuration

## Step 1) Create config file

In the LXC Security container on the FMADIO device go to the directory

```plaintext
/opt/fmadio/app/suricata/etc/
```

Create or Edit a file named

```plaintext
logger.lua
```

## Step 2) Set remote details

Edit the file by, adjusting the IP address, username, password based on your environment

```lua
local Config  = {}

Config.CHHost = "127.0.0.1"
Config.CHUser = "default"
Config.CHPass = "secret"

return Config
```

### Step 3) Wait for data

Once updated, the system should automatically use the new config file.

---

### Debugging

Check the system log file for errors

### Syslog

```plaintext
journalctl -f -u fmadio-logger.service
```

This will print out the log file

### Restart logger

Try restarting the logger process with below

```plaintext
systemctl restart fmadio-logger.service
```

Watch the above journalctl output