Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anybody know of a good tool to collect and analyse the application logs from a number of different Windows servers running on VMWare? All servers are on the same domain.

Ideally the tool would be free and open source.


share|improve this question

Splunk is the new hot player on the market. It's a sorta-free model. A single server is free, but if you want to correlate multiple servers logs into a single server you need to pay.

Zenoss has a much less robust log aggregator, but it works, and you can do many other things with Zenoss as well. Zenoss operates under a sorta-free model as well, but there is no limit on the free version, only a few missing features.

FWIW, I would pay for splunk. It's that good

share|improve this answer
Splunk is extremely expensive. LogZilla will do the same thing for far less money and scales extremely well. (also has a much easier interface). – Clayton Dukes Jun 27 '12 at 15:14
And now there's logstash as well. – Joseph Kern Jul 19 '12 at 9:30

I use a combination of SyslogD, snare and Splunk for my log analysis. SNARE sits on the windows server and pipes the eventlogs to my central syslogd logging server (which is also my Nagios server)

I then use Splunk to analyse them on the one server only, abiding by (in my eyes at least) the server license.

I have posted semi-instructions on how to do this on my blog at Central Syslog for Servers

This also takes care of my Pix's and other equipment that can redirect their logging.

share|improve this answer

Here are some instructions on setting up snare and splunk:

share|improve this answer

Microsoft EvenComb. Down and dirty does a nice job.

share|improve this answer
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Scott Pack Dec 5 '12 at 16:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.