Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Alternatives to Splunk?

I need to deploy a centralized log management device or appliance. It should be able to handle at least 100 devices giving it input. I would also like the ability for it to send me alerts when certain things are caught.

I have looked at splunk and free splunk doesn't alert you. Any other ideas? It can run on either windows or linux it doesn't matter.

share|improve this question

marked as duplicate by sysadmin1138 Jan 29 '12 at 0:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Although not strictly "log management", another possibility in managing large networks of devices is a monitoring system. In many cases it's useful to know now only if a device is reporting "error" or "ok" with a service, but also if that service (and the machine it's running on) is completely inaccessible. Systems like Nagios and Zenoss ( (both have open source and enterprise editions) will alert you of problems and can also parse logs to report problems that way too.

share|improve this answer
+1, What supervacuo is hinting at here is that logs are NOT the channel for monitoring i.e. alerting - they are diagnostic/auditing tools. – symcbean Jul 22 '10 at 12:28
Thanks for clarifying my spaghetti-verbiage! That's exactly what I'm trying to say — log parsing to get alerts is inserting an almost-always-unnecessary step in the process. – supervacuo Jul 22 '10 at 16:58

Give LogZilla a try (, my company has been using for a year now and I love it. It does have built-in alerting capability.

share|improve this answer

You could try syslog-ng store box appliance.

You could also simply do this with syslog-ng afcourse but the above is turnkey appliance.

share|improve this answer

Try CorreLog. Here is the link for the 30 day evaluation version.

Security event correlation, consolidation of logs, any platform. Check them out.

share|improve this answer

I have liked using Epylog:

You can write regex to catch what you wish and then act on it. Just central syslog the data and run epylog on a schedule.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.