Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to centralize logging for all my servers. Server operating systems include Windows 2003, 2008, Ubuntu and Redhat. I think Splunk is too expensive, has anyone set up something like this using open source or reasonably priced software. Please only answer if you have had experience using the product, I've already done a google search!

share|improve this question

closed as off topic by sysadmin1138 Jan 29 '12 at 13:19

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Please define "reasonably-priced." What's your budget? –  mfinni Feb 10 '11 at 19:23
    
Let's say under $2000. –  Antonius Bloch Feb 10 '11 at 19:37
    
Product and service recommendations are off topic per the FAQ. –  sysadmin1138 Jan 29 '12 at 13:19

6 Answers 6

up vote 5 down vote accepted

I use rsyslog and loganalyzer for my setup.

All logs go to a central logging file which I can view via web browser using loganalyzer.

I dug up a decent howto. I can not find the one I used when I set this up, but this should do nicely.

http://aaronwalrath.wordpress.com/2010/09/02/set-up-rsyslog-and-loganalyzer-on-centos-linux-5-5-for-centralized-logging/

share|improve this answer
    
Wow, relp and native ssl support. This looks like the one. If I could award part of the answer to Dave Mackintosh for suggesting NTsyslog2 for the Windows clients, I would. Thank you both. –  Antonius Bloch Feb 11 '11 at 20:18

I use syslog-ng (mostly because I found it and figured it out before rsyslog became big) as my central logging server. I like it because you can easilly set up per-host targets. This makes it much easier to sort through dense logs if you only have to do it one host at a time.

You might be interested in my example syslog-ng configuration for Linux. I set up the classic "messages" and "maillog" destinations that get everything from all sources, and then each individual source gets its own collection of dated files.

For Windows sources, I use a package called NTsyslog2, which I believe came from Google Code.

To parse it all, I have a shell script which I got from somewhere and then horribly mangled to fit my own specific requirements. It reads the single-logfile which has everything in it and emails me things that I've told it to look for.

One thing I will warn you about: make sure you keep tabs on your disk space, especially if you are sending lots of Windows servers' event logs to your syslog server.

share|improve this answer
    
I've used syslog-ng in the past, that's what I was planning on using. I noticed that they have become split commercial source, sometimes that's a bad thing... –  Antonius Bloch Feb 11 '11 at 20:06

Take a look at the open source nxlog tool which runs on various platforms (including Windows and Linux). It can collect from EventLog, files, syslog, database etc and has a wealth of other features.

share|improve this answer

You can use Octopussy (disclaimer: my project).

It's Open Source, it's free.

You can search through your logs, generate alerts and reports... and more ! :)

share|improve this answer
    
Looks cool, I'm going to check this out! –  Antonius Bloch Feb 11 '11 at 20:02

You could just use a free syslog server, it usually comes with most Unices including most Linux distributions, and one of the free NT syslog agents for your Windows boxes. Without knowing your budget or any unstated requirements, that will get you centralized logging, end of sentence.

I've done this.

Do you have any other requirements, or is centralized logging all you need?

share|improve this answer
    
Right now secure centralized logging is the need. Maybe a SQL backend could be considered a soft requirement. –  Antonius Bloch Feb 10 '11 at 19:38
1  
Define "secure". You could use IPSec to secure all syslog traffic. Why would a SQL backend be a requirement? I'm thinking of requirements in the sense of "what do you need to accomplish", not "what technology do I think will accomplish something that I may not have defined." Once it's in a SQL database, what would you be doing with it that you can't do with grep or Perl or LogParser? –  mfinni Feb 10 '11 at 20:49

i use zlogfabric

http://www.zlogfabric.com

you can also write your own modules windows integration is planned as far as i know

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.