Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I got several windows servers which run multiple instances of a software that produces logfiles. We are talking about 5-10MB per hour per server.

I want to collect these logs at a central server (in nearly realtime) and present them to other users via a web interface after authentication.

I have looked at Splunk but that seems be overkill and also is not free for multiple user accounts.

So I'd need a sync mechanism (perferably running as client on all servers) which pushes the log changes to a central server which collects these logs and makes them available via web interface.

share|improve this question

In my environment, I just set up Graylog2 as an aggregation point/browser interface, and nxlog as a forwarding agent to read in from log files and the system event log and forward them in GELF format to the Graylog2 server. nxlog can be a little finicky, but generally works pretty well. It's also available for Linux. Graylog2 does some nifty things like indexing logs into streams based on configurable search criteria and providing basic alerting on certain kinds of log messages.

You might also consider logstash. If you go this route, Kibana is a much better web interface than the one Logstash ships with.

share|improve this answer
From my experience, logstash is an awesome tool on it's own. I haven't used Kibana, but it looks to improve the interface considerably. – akraut Sep 29 '12 at 19:30

This is verging on a shopping question, so I'll keep the response vague

syslog-ng has a myriad of web interfaces - you'll need to evaluate which suit your needs best.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.