graylog VS ntopng

Graylog: An open source log management platform that provides real-time visibility into security events and facilitates incident response.

https://www.graylog.org/ but might be overkill.

Looks like the fix for this went in on March 28 and this should have been included in the April bugfix release 5.0.6

Sure! I use the Open Source of Graylog to search and build reports from the data. It sits on its own Droplet

Check out Graylog - https://www.graylog.org/ Graylog stores everything in elasticssearch, so you gan also use it as a datasource in Grafana.

Graylog

I use this to monitor my reverse proxy (SWAG) and fail2ban logs in conjunction. It's not as streamlined as GoAccess, GrayLog, Grafana, etc . . . but it is very personal. I divide all my connections into three buckets: Home, Outside, and Known Devices; and fail2ban statistics are layered against the all connections.

Graylog is an open-source centralized log management and analytics tool. It collects, enhances, correlates, searches, and visualizes all your log data in one location to uncover patterns and trends for application and IT infrastructure.

and use software: https://www.ntop.org/

InfluxDB 2.0 Support (ntopng github)

For what it's worth, there used to be a package in many Linux repositories called "ntop" [1] but became less popular when they went commercial. There is still a community version but I have no idea how popular it is any more. It was quite popular prior to projects like PiHole. Perhaps the older ntop has fallen out of favor so maybe there won't be any confusion.

[1] - https://www.ntop.org/

Have you seen https://github.com/ntop/ntopng?

NTOP -- Traffic Analysis.

One of the comments suggests using a managed switch that supports port mirroring, and installing a Flow collector on the connected system. Google netflow collector for software options. Something like ntop may work. See... HowTo Monitor Traffic in SMEs and Home Networks: A Primer

What can I do to implement GeoIP support into ntopng? The instructions I found on the internet (e.g. https://github.com/ntop/ntopng/blob/dev/doc/README.geolocation.md) did not seem to fit the case.