JP Vossen on 17 Mar 2014 10:51:10 -0700

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Syslog?

On 03/17/2014 11:18 AM, jeff wrote:
I had asked a while back about a decent syslog system.  Was wondering if
anything had changed.

My main focus is correlation.  Syslog outputs to that lovely advancing
wall of text.  What alternative is there to grep(ing) and regex(ing),
possibly with a GUI?  I'm looking to log-monitor a load of servers that
run The Other OS.  Would prefer to stay linux-based.

So what I'm hearing is that you want Splunk?

First of all, try...Splunk. The product is really great in lots of ways, including the fact that they "get" IT and the CLI but also have a really nice (Python-based) web GUI. They are usually very expensive, but there is a free license for low volume and they may have deals for non-profits. and

Second, there is LogStash, and you just HAVE to love the name and logo! It's Java, which annoys me, and I've had it run wild and consume all my resources, but that was at least 1.5-2 years ago, so...

You can roll your own with, but it's a lot easier to just use LogStash. See Also Apache Lucene or lots of similar tools, but now we're getting too low level.

2011 reviews of Syslog-ng GUIs, may be something useful:

Another list of options, also circa 2011, more in-line with this question:

There are more primitive tools like LogCheck that basically automate the 'grep & report' thing. That's what I personally use, but it's not for everyone.

Assuming Splunk is a no-go, my knee-jerk, for you, is a "loghost" VM with LogStash, and Snare (, to forward EventLogs. You can get that going in less than 1 day, for free, and go from there.

Start here:

Good luck,
JP Vossen, CISSP            |:::======|
My Account, My Opinions     |=========|
"Microsoft Tax" = the additional hardware & yearly fees for the add-on
software required to protect Windows from its own poorly designed and
implemented self, while the overhead incidentally flattens Moore's Law.
Philadelphia Linux Users Group         --
Announcements -
General Discussion  --