Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are currently evaluating log aggregation solutions at my company. I understand that Splunk is one of the best solutions, but what are some of the "negatives" with using Splunk? Is there anything else out there that maybe does a better job of log aggregation?

share|improve this question
    
We are trying to aggregate about 5GB/day of our application log data. Mainly to store it and search it; looking for problems with our application, developer debugging, support, etc. We have our application distributed at at a few hundred remote customer sites ( all over the US - and growing) and need to centralize our logs as we don't have access to the raw logs without going through the various customer system admin groups. This has become cumbersome for our application support staff and developers. –  pdaddy Apr 12 '10 at 16:11

2 Answers 2

up vote 1 down vote accepted

We use Splunk (the free version), and have found it to work very well. To answer your question best I would need to know what kind of logs you want to parse. You can count on being able to parse syslog and many other types of log files. However, for Windows event logs, you can still aggregate but you'll need to install Splunk on a Windows machine. Not necessarily a negative, but something to consider. The free version will let you gather from as many sources as you want, but you're limited in the amount of data per day (I think it's 500MB/day). I don't know exactly what the enterprise edition offers, but I think I remember it having an unlimited amount of data to index, multiple user accounts, and the ability to have multiple servers for indexing and searching.

Some of the downsides I've seen with our free edition are with the saved searches and notification. Using it to search is very powerful, and it does notification based off of saved searches, but this is a manual process for each search. It can e-mail results automatically, but this displays the raw format of the log. In order to have nicer e-mail notifications, I've had to create scripts for each saved search in order to send the e-mail the way I would like. I'm sure I'm probably using it differently than how it was designed to be used, but it's something to watch out for if you have the same uses in mind.

share|improve this answer

Splunk is fantastic. The only downside is that you're limited on the amount of logs you can parse with the free version. If you are willing to pay for Enterprise, it's probably the best solution out there.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.