Syslog Server – CGNAT Log Management & Analytics Platform

Overview

A Dockerized CGNAT log platform that ingests router syslog, parses and enriches it, stores it in ClickHouse and lets operators trace a public IP and port back to a subscriber.

Architecture

What I built

• Built a Dockerized CGNAT log platform that ingests router syslog, parses and enriches it, stores it in ClickHouse and lets operators trace a public IP and port back to a subscriber.
• Developed the Vector pipeline in VRL with parsers for MikroTik RouterOS 6/7, Cisco IOS/IOS-XE, Cisco CGN NAT44, Juniper and vBNG, with router authorization, deduplication and GeoIP/ASN enrichment.
• Added runtime parser management through a FastAPI control plane: new parsers are validated, written atomically and hot-reloaded without rebuilding the image.
• Designed the ClickHouse schema with daily partitions, ZSTD compression, skip indexes, hourly rollups from materialized views, configurable retention and an S3 cold tier.
• Delivered the management portal in Laravel 12, React 19 and TypeScript (Inertia.js): CGNAT search and reports, dashboards, router inventory, RBAC, activity auditing, alerts and licensing.
• Automated releases with GitLab CI/CD, BuildKit and Harbor: tag-verified builds, chained downstream pipelines, smoke tests, Cosign-signed images, and pgBackRest backups to MinIO.