Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently, my organization is using Splunk to store logs from various places (DBs, Apache, systems we write, etc.). We don't really use most of its abilities (pull logs automatically, etc.), but we do require the search it provides - showing the event and some of its surroundings.

Recently the free version of Splunk started giving us hard time, so we would like to replace it with some other tool, even with less features, as long as it could index and search over large amount of logs.

Could you please offer such alternatives?

EDIT: while the suggestions given are great, none offer the searching and indexing capability I need. Can you offer something else?


locked by HopelessN00b Dec 5 '14 at 10:37

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

Required to be free? You can have a look at Arcsight Logger, free up to 750 MB per day. Note that Logger is a SIEM, while Splunk is not. – Frands Hansen Jan 28 '12 at 22:36
Thanks Frands. Unfortunately, the free license for Arcsight Logger allows merely 50GB of logs, which is less than what I have. During the time since I posted this question, we've started considering for-fee products such as Ativio. – Moshe Jan 30 '12 at 13:15

Syslog-ng is a one of the traditional ways to centralize your logs. This older article explains how to set this up. The article doesn't include indexing exactly, but shows you how to set up Log check to filter the logs using regex and get notified of non-trivial events.


In the past, I had centralized logging enabled via syslog-ng, but more recently, at a new site, I've switched to rsyslog. Here's a good comparison:


Rsyslog as a log collector (you can run nearly any syslog on each client) and phplogcon as a UI for viewing the log data will do the job. Be warned, I found the documentation for rsyslog to be seriously lacking and majorly frustrating at times. I was able to make it do everything I wanted, but it took me many more hours to get things working than it did for me to get syslog-ng free working. See the phplogcon demo site to see the search and filtering interface in action.


As a log system I will recommend rsyslog, as its features and license has made the default in some Linux distributions. If you want a tool to search in those logs you may look at Octopusy ( )

You can also get more feedback on another question: Alternatives to Splunk?


Not the answer you're looking for? Browse other questions tagged or ask your own question.