Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm helping to evaluate a couple of centralized log collection and reporting tools. To help in testing the tools, I'd like to be able to generate large numbers of simulated log messages. Preferably, I'd like to generate large quantities of logs that are formatted to appear to be valid logs for various devices like Unix servers, Windows servers, Cisco routers, etc.

Searching on Google, I found that there used to be a tool called Snare Generator that did this sort of thing, but it doesn't look like it's available anymore (the Snare website still has the documentation for Snare Generator, but I can't see where to download it).

Does anyone out there know of a good tool for generating lots of simulated log data? Or alternatively, do you know if it's still possible to get Snare Generator somewhere?


locked by HopelessN00b Dec 5 '14 at 8:59

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

up vote 2 down vote accepted

I would suggest getting some samples from:

They have logs from attacks, errors, failures, multiple devices, etc that you can throw against your tool to test.


I don't know if this is what you want or not, but the logger command allows you to send any messages you want to the syslog system

I'm aware of logger, what I was hoping for is a way of generating log data that's formatted so that it looks like valid logs for specific devices. – Bob McCormick May 12 '09 at 17:51

Bearing in mind that I don't know why you require this, but something I would be asking would be what are you gaining by evaluating a system using 'random' data? You should really be evaluating the tools while they are experiencing as close as possible to the loads and data that it will be handling after going live. Otherwise it isn't a real evaluation.

As a suggestion, and assuming that you already have a collection of hosts that are logging to a syslog server, you could simply redirect the messages to the syslog server, as well as keeping the existing logs going. For standard syslogd, start the daemon with the -h flag and add a line to the beginning of your syslog.conf like this:

The purpose is to know how much messages get lost, or at which load messages are getting lost. Also if you configured your logserver properly not to run out of space in case of massive amounts of messages. Testing prior to running the stuff is just a good practice. Just imagine you have some weird component that blocks if it can't submit to a log server and you find that out at Saturday 3AM when you phone wakes you up – Server Horror Jun 15 '09 at 15:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.