Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu server. What are good tools that monitor my logs and can send me email notifications when errors (or other types of messages) occur? I've heard of logwatch and logcheck. What are others?

share|improve this question

closed as not constructive by Sven, joeqwerty, Tim Brigham, Zoredache, John Gardeniers Feb 23 '12 at 22:57

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Thanks for all the recs. – David Xia Feb 23 '12 at 19:56
up vote 0 down vote accepted

I have been incredibly impressed with graylog2 It does a decent job. In the slightly older version it was leveraging mongodb to make capped data collections. Now it's moved on to elasticsearch. Pretty cool!

share|improve this answer
This quote got me. "Manage your logs in the dark and have lasers going and make it look like you're from space." – David Xia Feb 23 '12 at 19:56

You may be interested in Splunk also.

share|improve this answer
-1 Splunk is crazy expensive, and the basic version is very limited. Caution! – samsmith Feb 24 '12 at 1:15

Try the Simple Event Correlator (SEC). Pretty steep learning curve. But once you figure it out, you can easily build rules to watch your logs in real time.

share|improve this answer

You may be interested in using LogZilla. It is free for small networks and does everything you need very well. Full disclosure: I am the creator :-)

share|improve this answer

logwatch and logcheck run periodically, so these might not be the best choice if you need real-time alerting. There is also log2mail. Syslog-ng and nxlog can do real-time alerting based on patterns (disclaimer: I'm affiliated with the latter).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.