To have a visibility on scans performed on my VPS instances, I have configured the local vector service to read kernel logs from journald and forward UFW blocks to Loki.
However, Loki is not optimized to generate statistics from logs and can slow down when having a high amount of logs to handle.
That's why I have developped a Prometheus Exporter in Python that runs as a systemd service and generates statistics of connections per IP and connections per Port for the last hour.
Repository : github.com/janbellon/scan_exporter
