Features & Reports

A complete ISP internet-connection logging solution — NetFlow, subscriber sessions and device logs collected, attributed to real users, stored efficiently, and reportable on demand. Built for Bangladesh BTRC / Cyber Police Bureau compliance.

Enterprise-grade columnar log store
NetFlow v9 / IPFIX ingestion
1M+ rows/sec insert capacity
~18 bytes/flow compressed
White-label branding
Web dashboard — no client software
01

Reports & Pages

Every report is live from the database, filterable by date/time range, and exportable to Excel-compatible CSV. All pages share a clean, responsive dark theme that works on desktop, tablet and phone.

📊

Dashboard Report

The at-a-glance operational picture, first page after login.

  • Flow Records (last hour) — live ingestion volume
  • Total vs Online routers — online = flows seen in the last 5 minutes, never a fake badge
  • Active subscriber sessions count
  • Router Health — Online / Offline tabs with per-router last-seen
  • Quick links into every report
🔍

Activity Log Report

The core compliance report: who connected to what, when — every internet connection with the subscriber behind it.

  • Time · User / MAC · Source IP:Port / NAT · Destination · Router
  • Date-time range picker + free search (IP, user, domain, MAC)
  • Filter by router dropdown
  • Destination labeled with its network owner (GOOGLE, FACEBOOK, CLOUDFLARE…) even without DNS
  • Local/multicast chatter hidden by default (toggle to show)
  • CSV export with the full flat column set
📟

Device Logs (Syslog) Report Admin

Router/device event logs collected centrally over remote syslog.

  • Colour-coded severity badges (error / warning / info …)
  • Severity filter + date range + search
  • MikroTik topic parsing (severity derived from log topics)
  • CSV export
🗄️

Storage Overview Report Admin

Per-table row counts, on-disk size and date coverage — know exactly what is stored and how much space it takes.

💻

System Status Admin

Live server health, auto-refreshing every 10 seconds.

  • CPU, RAM, disk utilisation
  • Load average (1/5/15 min) with in-app explanation
📖

Built-in Help / FAQ Admin

A full in-app operator guide — no external documentation needed.

  • Live search with term highlighting
  • Router setup steps auto-filled with this server's real IP/ports/secret
  • Explains every page, switch and metric in plain language
02

User Attribution

Raw NetFlow only contains IP addresses. The Log Server joins every flow against live subscriber-session data so the Activity Log shows the actual username and MAC address behind each connection.

🎯 Automatic flow-to-subscriber matching

Every flow is matched against the subscriber-session table by IP and time window — a connection is attributed to the user who actually held that IP at that moment, correct even after IPs are re-assigned.

Outbound (upload) matchSubscriber matched on the flow's source IP — the primary attribution path.
Inbound (download) matchOptional per-router switch also attributes users on destination IP, for routers that export pre-NAT.
NAT IP shown per userThe subscriber's NAT/NAS address is displayed alongside the private IP.
Honest unmatched labelingRows that can't be attributed show "—", never a fake user. Known infrastructure ranges get an INFRA badge instead.

🏷️ Destination intelligence

Destinations are labeled with the owning network (GOOGLE, FACEBOOK, AMAZON…) via an offline IP-to-ASN database — zero external queries, works without DNS capture. A real DNS domain wins when available.

03

Data Collection

Four independent, auto-restarting collector services feed the database. All of them survive crashes, reboots and network blips without operator action.

🌊

NetFlow / IPFIX collector

High-throughput pipeline receiving NetFlow v9 / IPFIX from every router on UDP 2055.

  • Multi-core scaling — field-proven at 23k+ flows/s sustained
  • Parallel insert workers with back-pressure (no unbounded RAM)
  • Large batched inserts tuned for the storage engine
  • Optional drop local/multicast at ingest to save ~⅓ disk on noisy routers (off by default — compliance first)
📡

Subscriber sessions — MikroTik API

Polls every managed router's active PPPoE + Hotspot sessions over encrypted API-SSL.

  • Session start back-dated from router uptime — accurate windows
  • Session end recorded when a user disconnects
  • Routers added/removed take effect without restarts
📻

Subscriber sessions — RADIUS accounting

Standards-based RADIUS accounting receiver (Start/Stop) for BNG/NAS equipment of any vendor.

  • Passive by default — never interferes with the ISP's real AAA
  • Crash-proof packet handling
📜

Remote syslog receiver

Collects router/device event logs on UDP 5514.

  • Handles both standard RFC3164 and MikroTik's headerless format
  • Severity derived reliably from MikroTik topics
04

Router Management

Adding a router takes one form: IP + API credentials. The server configures the router itself — no manual NetFlow or syslog setup on the device.

⚡ Zero-touch onboarding Admin

One click configures NetFlow export + remote syslog + session polling on the router over its encrypted API — idempotent, and it never touches other collectors or unrelated router config.

Per-router Logging switchOff removes this server's export config from the router (at the source); On re-applies it. Fully reversible.
Per-router Polling switchPause/resume username+MAC collection per router without losing flow logging.
Per-router Inbound switchEnable download-direction user matching where the router's export topology supports it.
Edit in placeChange name/IP/credentials; router is reconfigured only when the connection details actually changed.

🩺 Live router health

Online/Offline is computed from real flow recency (seen in the last 5 minutes) — a dead exporter can't hide behind a stale green badge. Unmanaged routers observed in flows are listed too, so nothing sends data unnoticed. The list has instant search by name or IP and pagination for large fleets.

05

Storage, Archive & Two-Node Backup

Compliance data is precious: every destructive operation is gated behind a confirmed copy. Nothing in this system can delete a row that isn't archived somewhere else first.

🗜️

Extreme compression

A purpose-built columnar analytics engine — the same class of technology behind Cloudflare's and Uber's logging — compresses connection logs to ~18 bytes per flow, about 1 TB per 1,000 users per year. A year of logs for a mid-size ISP fits on ordinary disks.

📦

Archive & Cleanup Admin Safety-gated

Date-range archive downloads a ZIP of CSVs per table; deletion of the same range is locked until the archive has been downloaded, then double-confirmed.

🔁

Two-node backup v1.8 Safety-gated

Primary keeps a fast hot window (default 7 days); a Backup node holds the long-term archive.

  • Server-side database-to-database sync — compressed, no middleman
  • Watermark-based: duplicate-free and loss-free
  • Prune hard-gate: the Primary re-counts rows on the Backup and refuses to delete anything the Backup doesn't already hold
  • Status panel: per-table watermark, lag, last run, reachability
  • Everything off by default; manual Sync-now / Prune-now controls
🕐

Timezone-correct records

OS and database clocks are aligned at deployment (e.g. Asia/Dhaka) so stored and displayed timestamps always agree — no off-by-six-hours evidence.

06

Security & Access Control

Two roles, strictly enforced at the route level — restricted pages are blocked on the server, not merely hidden from the menu.

👤

Role-based access

  • Admin — everything: users, routers, maintenance, backup, syslog, status
  • Viewer — Dashboard + Activity Log only; can search and export but change nothing
  • Typing a restricted URL redirects — enforcement is server-side
🔐

Hardened authentication

  • Salted PBKDF2 password hashing
  • Signed session cookies, secret generated per install
  • User management UI (add / remove / role) for admins
🛰️

Encrypted router control

All router configuration and polling runs over API-SSL; router credentials are stored in a 600-permission file outside the web root and never shown back in the UI.

07

Deployment & Operations

From blank Ubuntu server to fully-running log server in one command.

🚀

One-script deployment

start-deployment.sh installs and configures everything: database, web server, all collector services, schemas, timezone, systemd units — end to end on a fresh machine.

♻️

Self-healing services

Every service runs under systemd with Restart=always and pipeline failure propagation — a crashed or cleanly-exited collector restarts itself; ingestion never silently stays down.

🎨

White-label branding

Brand name flows from one config line into the nav, titles, login screen and archive manifests — same product, each ISP sees its own identity.

📱

Responsive dark UI

Desktop, tablet and phone layouts; wide tables become labelled cards on small screens. No JavaScript frameworks — fast, dependency-free pages.

📈

Scales with hardware

Ingestion scales linearly across CPU cores via configuration alone — field-proven from 4-core boxes to multi-core fleets at 23k+ flows/s. A published hardware sizing guide maps router count to server spec.

🧾

Versioned releases

Tagged product versions with a full changelog; per-client config is isolated from product code, so every ISP upgrades from the same tested release.

08

Access Matrix

What each role can see and do.

Page / ActionViewerAdminExport
Dashboard
Activity Log (search & filter)CSV
Device Logs (Syslog)CSV
System Status (CPU/RAM/disk)
Routers (onboard / switches / edit)
Users (manage accounts & roles)
Maintenance — Storage Overview
Maintenance — Archive dataZIP of CSVs
Maintenance — Delete data (archive-gated)
Two-Node Backup (config / sync / prune)
FAQ / Help guide