You can use Munin. It's very easy to setup on the clients. You instantly get a large amount of very diverse performance data in a form of hourly, daily, weekly, and monthly graphs. The images are organizes in HTML pages. One page can be one client or a large group of clients.
Performance problems are easy to spot when you have it side-by-side with a history of good performance. Munin sends you an email when a threshold is crossed (default thresholds are there, but you can re-define them).
The shipped set of plugins (data collectors) is rather comprehensive. You got memory (+swapping/page faults), CPU, disk, network, temperature, NTP time drift, logins (break-in attempts), database statistics, web-server statistics and many more. You get that instantly when a client is setup.
It also very easy to write your own plugins. A plugin is just a program that outputs some numbers to standard output (in plain text). I wrote and used many useful plugins for several years. My site is a Bioinformatics cluster at a large University. We have a large amount of Linux compute nodes, databases, web servers, and workstations. Nagios can also plot graphs but it will not have such a diverse set of data collectors for graphing. Monitoring Windows and Solaris workstations should be easy too.
There is also a Munin plugin exchange website.
Munin is not designed to parse or filter log files (like Nagios). But there are some plugins that count various messages in log files (such as logins and break-in-attempts for SSH). You can easily write log reading plugins but keep in mind that you will have to summarize the information in a few numbers which change through time. I think in your case - most of the analysis of log should be done manually after a performance problem has been detected. Since Munin plugins are so diverse, it will usually raise several "red flags" (send you emails) when a problem does occur.
It important to do a good job of adjust the thresholds so that the frequency of false positive alert is close to never.
Alex