graylog VS Fog

Graylog: An open source log management platform that provides real-time visibility into security events and facilitates incident response.

https://www.graylog.org/ but might be overkill.

Looks like the fix for this went in on March 28 and this should have been included in the April bugfix release 5.0.6

Sure! I use the Open Source of Graylog to search and build reports from the data. It sits on its own Droplet

Check out Graylog - https://www.graylog.org/ Graylog stores everything in elasticssearch, so you gan also use it as a datasource in Grafana.

Graylog

I use this to monitor my reverse proxy (SWAG) and fail2ban logs in conjunction. It's not as streamlined as GoAccess, GrayLog, Grafana, etc . . . but it is very personal. I divide all my connections into three buckets: Home, Outside, and Known Devices; and fail2ban statistics are layered against the all connections.

Graylog is an open-source centralized log management and analytics tool. It collects, enhances, correlates, searches, and visualizes all your log data in one location to uncover patterns and trends for application and IT infrastructure.

I heard about devbox [1] but I haven't tried it yet. Perhaps it could suit your needs.

Back in the day I used "Norton Ghost" to create a full image of a just-installed windows just in case I needed to go back in time. Windows includes a snapshot feature built-in but I did not really trusted it. These days you can use a "sysprep" tool [2] to create a similar system snapshot. Make a partition and keep everything you don't want deleted on drive D: or something :-).

--

1: https://www.jetpack.io/devbox

2: like https://www.ntlite.com or https://fogproject.org

For provisioning the machines base image consider FOG it uses PXE and can remotely provision dozens of machines using multicast.

Same. We set up 1 device how we want to, then use FOG to clone the other devices

With standard computers, I usually deploy something like the fog project and automate the process over pxe with scheduled reboots. I guess you could do that as well with your VMs but that seems overkill.

you could setup a PXE server and automate installs. you could also clone them and reapply the image as needed. https://fogproject.org/ or lookup CloneZilla both are open source

Free: https://fogproject.org/ or https://clonezilla.org/

Microsoft used to have a free tool called SteadyState to do this, but it's been discontinued for a while. It took a different approach of undoing changes rather than restoring from image but it worked great with Kiosk mode. There are remote management tools that can wipe and reimage managed machines, most of them don't require an AD domain. As an example FOG Project.