1

I got several windows servers which run multiple instances of a software that produces logfiles. We are talking about 5-10MB per hour per server.

I want to collect these logs at a central server (in nearly realtime) and present them to other users via a web interface after authentication.

I have looked at Splunk but that seems be overkill and also is not free for multiple user accounts.

So I'd need a sync mechanism (perferably running as client on all servers) which pushes the log changes to a central server which collects these logs and makes them available via web interface.

2 Answers 2

3

In my environment, I just set up Graylog2 as an aggregation point/browser interface, and nxlog as a forwarding agent to read in from log files and the system event log and forward them in GELF format to the Graylog2 server. nxlog can be a little finicky, but generally works pretty well. It's also available for Linux. Graylog2 does some nifty things like indexing logs into streams based on configurable search criteria and providing basic alerting on certain kinds of log messages.

You might also consider logstash. If you go this route, Kibana is a much better web interface than the one Logstash ships with.

1
  • From my experience, logstash is an awesome tool on it's own. I haven't used Kibana, but it looks to improve the interface considerably.
    – akraut
    Sep 29, 2012 at 19:30
0

This is verging on a shopping question, so I'll keep the response vague

syslog-ng has a myriad of web interfaces - you'll need to evaluate which suit your needs best.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .