Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm looking for some program or utility to create a centralized log monitoring server for a mixed Windows and Linux environment. Any suggestions? Essentially we want a place to look at the system and event logs for over 100 servers. Free is always better

share|improve this question

4 Answers 4

up vote 4 down vote accepted

splunk

http://www.splunk.com

I think your overall best option is probably to go with Splunk since you're in a mixed environment. Depends on how much you want to log and if you can afford to pay. If you're selective about what you want to log you might just be able to get away with it for free.


OSSEC

http://www.ossec.net

While not EXACTLY what you're looking for, OSSEC will aggregate all of your logs to a single server with a fairly small amount of configuration. OSSEC can also integrate with Splunk which makes it even more interesting. Here's a snippet from their home page:

OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.


Roll your own

This appears to be an older post but it might help anyway:

http://www.johnhsawyer.com/2006/03/centralized-logging-for-windows-using.html

You can also take a look at a previous question I answered here regarding sending log files securely to syslog-ng. (at least for the Linux side anyway):

http://serverfault.com/questions/20840/how-would-you-send-syslog-securely-over-the-public-internet

Hope this helps.

share|improve this answer
    
Thanks for the answer. I'll definitely check out these products. –  Fishwalker Sep 14 '09 at 20:32

Splunk!!!! Splunk!!! Splunk!!!! I use it for a mix of Networking devices, Linux, Solaris, Windows. The only issue is to keep under the free level, you need to be very specific what logs you want to keep, but I found as long as I was diligent in cutting down on chatter, and really only logging the info I needed, I had no problem.

http://www.splunk.com/

share|improve this answer
    
Excited much? –  Dennis Williamson Sep 14 '09 at 16:45
    
For Splunk? Yeah. Love it... or rather more specifically, I loved the solution I was able to get to Pointy Haired bosses. "WOW!!! Pictures that move" –  breadly Sep 14 '09 at 17:21
    
lol. pictures that move. My only issue with splunk is in my environment, the things i NEED to log, are way way over 500mb / day. –  GruffTech May 21 '10 at 13:26
    
Yeah... that is the issue. When I originally spec'd it out, I think the cost was 100k :-( I eventually scaled it down to just critical systems. –  breadly Jun 4 '10 at 15:56

If you're stupidly wealthy, splunk is pretty deadly. If you're not, it may be worth looking at some combination of syslog (-ng or rsyslog), Ossec-hids, and octopussy.

Since writing this, several interesting options have shown up for this. Logstash, graylog2. and ELSA all seem to replicate most of the features of Splunk, and are free/OSS.

Really though, you probably want splunk.

share|improve this answer

I'd recommend EventSentry since I work at the company that makes it. I don't want to turn this into an advertisement so I'll leave it at that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.