A complete ISP internet-connection logging solution — NetFlow, subscriber sessions and device logs collected, attributed to real users, stored efficiently, and reportable on demand. Built for Bangladesh BTRC / Cyber Police Bureau compliance.
Every report is live from the database, filterable by date/time range, and exportable to Excel-compatible CSV. All pages share a clean, responsive dark theme that works on desktop, tablet and phone.
The at-a-glance operational picture, first page after login.
The core compliance report: who connected to what, when — every internet connection with the subscriber behind it.
Router/device event logs collected centrally over remote syslog.
Per-table row counts, on-disk size and date coverage — know exactly what is stored and how much space it takes.
Live server health, auto-refreshing every 10 seconds.
A full in-app operator guide — no external documentation needed.
Raw NetFlow only contains IP addresses. The Log Server joins every flow against live subscriber-session data so the Activity Log shows the actual username and MAC address behind each connection.
Every flow is matched against the subscriber-session table by IP and time window — a connection is attributed to the user who actually held that IP at that moment, correct even after IPs are re-assigned.
Destinations are labeled with the owning network (GOOGLE, FACEBOOK, AMAZON…) via an offline IP-to-ASN database — zero external queries, works without DNS capture. A real DNS domain wins when available.
Four independent, auto-restarting collector services feed the database. All of them survive crashes, reboots and network blips without operator action.
High-throughput pipeline receiving NetFlow v9 / IPFIX from every router on UDP 2055.
Polls every managed router's active PPPoE + Hotspot sessions over encrypted API-SSL.
Standards-based RADIUS accounting receiver (Start/Stop) for BNG/NAS equipment of any vendor.
Collects router/device event logs on UDP 5514.
Adding a router takes one form: IP + API credentials. The server configures the router itself — no manual NetFlow or syslog setup on the device.
One click configures NetFlow export + remote syslog + session polling on the router over its encrypted API — idempotent, and it never touches other collectors or unrelated router config.
Online/Offline is computed from real flow recency (seen in the last 5 minutes) — a dead exporter can't hide behind a stale green badge. Unmanaged routers observed in flows are listed too, so nothing sends data unnoticed. The list has instant search by name or IP and pagination for large fleets.
Compliance data is precious: every destructive operation is gated behind a confirmed copy. Nothing in this system can delete a row that isn't archived somewhere else first.
A purpose-built columnar analytics engine — the same class of technology behind Cloudflare's and Uber's logging — compresses connection logs to ~18 bytes per flow, about 1 TB per 1,000 users per year. A year of logs for a mid-size ISP fits on ordinary disks.
Date-range archive downloads a ZIP of CSVs per table; deletion of the same range is locked until the archive has been downloaded, then double-confirmed.
Primary keeps a fast hot window (default 7 days); a Backup node holds the long-term archive.
OS and database clocks are aligned at deployment (e.g. Asia/Dhaka) so stored and displayed timestamps always agree — no off-by-six-hours evidence.
Two roles, strictly enforced at the route level — restricted pages are blocked on the server, not merely hidden from the menu.
All router configuration and polling runs over API-SSL; router credentials are stored in a 600-permission file outside the web root and never shown back in the UI.
From blank Ubuntu server to fully-running log server in one command.
start-deployment.sh installs and configures everything: database, web server, all
collector services, schemas, timezone, systemd units — end to end on a fresh machine.
Every service runs under systemd with Restart=always and pipeline failure propagation — a crashed or cleanly-exited collector restarts itself; ingestion never silently stays down.
Brand name flows from one config line into the nav, titles, login screen and archive manifests — same product, each ISP sees its own identity.
Desktop, tablet and phone layouts; wide tables become labelled cards on small screens. No JavaScript frameworks — fast, dependency-free pages.
Ingestion scales linearly across CPU cores via configuration alone — field-proven from 4-core boxes to multi-core fleets at 23k+ flows/s. A published hardware sizing guide maps router count to server spec.
Tagged product versions with a full changelog; per-client config is isolated from product code, so every ISP upgrades from the same tested release.
What each role can see and do.
| Page / Action | Viewer | Admin | Export |
|---|---|---|---|
| Dashboard | ✔ | ✔ | — |
| Activity Log (search & filter) | ✔ | ✔ | CSV |
| Device Logs (Syslog) | ✘ | ✔ | CSV |
| System Status (CPU/RAM/disk) | ✘ | ✔ | — |
| Routers (onboard / switches / edit) | ✘ | ✔ | — |
| Users (manage accounts & roles) | ✘ | ✔ | — |
| Maintenance — Storage Overview | ✘ | ✔ | — |
| Maintenance — Archive data | ✘ | ✔ | ZIP of CSVs |
| Maintenance — Delete data (archive-gated) | ✘ | ✔ | — |
| Two-Node Backup (config / sync / prune) | ✘ | ✔ | — |
| FAQ / Help guide | ✘ | ✔ | — |