

I hear you Mr Audiophile. Thing is, all that space it takes to house a grand collection, when it all now fits on two 10TB drives filled with high res flac. I can’t tell a difference. Not saying there isn’t one, just saying I can’t hear it. So, for me, it works out perfect.
On the free plan, you should be able to set up 2 remediation components, 4 blocklists, and a variety of scenarios. For the scenarios, I’d only install what you have need for.
As far as logs, I personally think something more along the lines of Grafana+Loki+Alloy (Formerly Prometheus) for logs and metrics. You could even use something like lnav. Lnav is simple to install. It’s not a dialed out dashboard of metrics, rather it keeps things simple. After install, to access it simply type lnav and the log location you wish to view:
lnav /var/log/auth.log
orlnav /var/log/syslog
in the cli. Don’t let it’s simplicity fool you tho. It is quite capable.I really tried with logging aps like ELK, Graylog, etc. I found them to be quite heavy for my environment. They certainly do have all the bells and whistles and pretty graphics, but again, it comes down to what can run on your server comfortably. I didn’t want to eat up 2/3 of my resources just to look at logs. The Grafana+Loki+Alloy combo really sips the resources. I think for all I have Grafana monitoring, it clocks in at around 2+/- gb in used resources.