Skip to content

Getting Started

Installation

The full installation walkthrough for Windows and Linux, including what the installer does, where files land, and how to verify the result.

Prerequisites

  • Windows 10 (64-bit), Windows 11, or Windows Server 2019 / 2022 / 2025
  • Administrator access
  • Inbound network access on UDP 514, TCP 6514, and TCP 5000
  • Ubuntu 22.04 or 24.04 LTS (64-bit)
  • sudo / root access
  • systemd (standard on supported releases)
  • Inbound network access on UDP 514, TCP 6514, and TCP 5000

See the full System Requirements for capacity guidance.

Download

Download the latest installer from lucedev.com/products/lucedev-syslog.

Install

  1. Right-click LuceDevSyslog_v1.0.3.exe and choose Run as administrator
  2. Accept the license agreement
  3. Confirm the install directory (default: C:\Program Files\LuceDev Syslog)
  4. Click Install

The installer will automatically:

  • Copy application files to the install directory
  • Create data/, logs/, certs/, and archives/ folders for runtime data
  • Register the LuceDevSyslog Windows service (via WinSW) and start it
  • Add three Windows Firewall rules: UDP 514, TCP 6514, TCP 5000
  • Open the dashboard in your default browser

  1. Download the archive:

    wget https://lucedev.com/static/downloads/LuceDevSyslog_v1.0.3_linux_amd64.tar.gz

  2. Extract it:

    tar -xzf LuceDevSyslog_v1.0.3_linux_amd64.tar.gz

  3. Run the installer:

    cd LuceDevSyslog
sudo bash install.sh

The installer will:

  • Copy application files to /opt/lucedev-syslog/
  • Create the lucedev system user
  • Create data directories at /var/lib/lucedev-syslog/ and /var/log/lucedev-syslog/
  • Symlink data/, archives/, certs/, logs/, settings.json, and license_state.json from the install directory to those data dirs so upgrades preserve user data
  • Install and enable the lucedev-syslog systemd service with CAP_NET_BIND_SERVICE so it can bind UDP 514 without running as root
  • Add UFW rules for UDP 514, TCP 6514, and TCP 5000 (only if ufw is installed — otherwise prints the rules to add manually)
  • Print the dashboard URL on completion

Verify

sc query LuceDevSyslog

Look for STATE: 4 RUNNING. You can also open services.msc and find the LuceDev Syslog entry.

sudo systemctl status lucedev-syslog

The service should show active (running). Live log stream:

sudo journalctl -u lucedev-syslog -f

Open the dashboard

Browse to http://<server-ip>:5000. You should see the login screen.

Send a test message

# Linux/macOS — using the standard `logger` utility
logger -n <server-ip> -P 514 "Test syslog message from $(hostname)"

# Windows PowerShell — from another machine
$udp = New-Object System.Net.Sockets.UdpClient
$bytes = [Text.Encoding]::ASCII.GetBytes("<14>Test syslog message from PowerShell")
$udp.Send($bytes, $bytes.Length, "<server-ip>", 514)
$udp.Close()

The message appears on the dashboard within seconds (live refresh runs every 15 seconds).

Directory layout

C:\Program Files\LuceDev Syslog\
├── LuceDevSyslog.exe          # Main application
├── LuceDevSyslog-service.exe  # WinSW service wrapper
├── LuceDevSyslog-service.xml  # Service configuration
├── lucedev.ico                # Application icon
├── open_dashboard.bat         # Dashboard launcher (reads port from settings.json)
├── settings.json              # Server configuration (created on first run)
├── license_state.json         # License validation cache
├── data/                      # SQLite database
│   └── syslog.db
├── logs/                      # Application logs
├── certs/                     # TLS / HTTPS certificates
└── archives/                  # Gzipped CSV log archives

/opt/lucedev-syslog/                # Application files
├── LuceDevSyslog                   # Main binary
├── data/ → /var/lib/lucedev-syslog/data/         (symlink)
├── logs/ → /var/log/lucedev-syslog/              (symlink)
├── certs/ → /var/lib/lucedev-syslog/certs/       (symlink)
├── archives/ → /var/lib/lucedev-syslog/archives/ (symlink)
├── settings.json → /var/lib/lucedev-syslog/settings.json
└── license_state.json → /var/lib/lucedev-syslog/license_state.json

/var/lib/lucedev-syslog/            # Persistent runtime data
├── data/syslog.db
├── certs/
├── archives/
├── settings.json
└── license_state.json

/var/log/lucedev-syslog/            # Application logs

Don't delete the data directories

The data, certs, archives, and settings.json files contain your database, configuration, and certificates. They're preserved during upgrades. Only delete them if you want to start completely fresh.

Default credentials

Field Value
Username admin
Password password

You're forced to change the password on first login. New password must be at least 8 characters.

Firewall rules added by the installer

Protocol Port Purpose
UDP 514 Standard syslog
TCP 6514 TLS syslog
TCP 5000 Web dashboard

If you change any of these ports in Settings → Server, add a corresponding firewall rule for the new port. See Ports & Firewall for examples.

Next steps