xsrv VS graylog

Yes, OpenLDAP installed from this ansible role

It's dead easy to use TCP/SSL instead of UDP to forward logs. Example rsyslog config

I use rsyslog for that since it's the default in Debian. Configuring forwarding is very simple, a single file in /etc/rsyslog.d/forwarding.conf [1]. Note that this setup uses TLS to encrypt messages so you need to create the relevant certificates (I use self-signed certs). Unencrypted TCP or UDP is simpler, but less secure.

preseed.cfg contains a few basic options needed to setup the OS [1]

I do this with https://github.com/nodiscc/xsrv/tree/master/roles/openldap + https://github.com/nodiscc/xsrv/tree/master/roles/samba. It's just a standalone samba server + LDAP auth for users, no DC or anything like that, so I'm not sure this is what you're looking for.

This ansible role (check the tasks/ directory) gives a good breakdown of what is needed to setup a basic LDAP server and authentication service

I use samba in standalone mode with or without LDAP auth https://github.com/nodiscc/xsrv/tree/master/roles/samba

Graylog: An open source log management platform that provides real-time visibility into security events and facilitates incident response.

https://www.graylog.org/ but might be overkill.

Looks like the fix for this went in on March 28 and this should have been included in the April bugfix release 5.0.6

Sure! I use the Open Source of Graylog to search and build reports from the data. It sits on its own Droplet

Check out Graylog - https://www.graylog.org/ Graylog stores everything in elasticssearch, so you gan also use it as a datasource in Grafana.

Graylog

I use this to monitor my reverse proxy (SWAG) and fail2ban logs in conjunction. It's not as streamlined as GoAccess, GrayLog, Grafana, etc . . . but it is very personal. I divide all my connections into three buckets: Home, Outside, and Known Devices; and fail2ban statistics are layered against the all connections.

Graylog is an open-source centralized log management and analytics tool. It collects, enhances, correlates, searches, and visualizes all your log data in one location to uncover patterns and trends for application and IT infrastructure.