Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As we continue to move away from NetWare and beginning to use Suse Linux as our server base, centralized logging is becoming more of an possibility. I know I can install syslog-ng, but beyond that, what good tools are available for log aggregation/archiving and in particular, viewing those logs in a central place via a common gui interface?


share|improve this question

closed as not constructive by HopelessN00b, Wesley, voretaq7 Dec 15 '12 at 5:15

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

php-syslog-ng might be worth a try. It also has a fully working demo on the website and some screenshots to get a first impression.

Quoting from the site:

Php-Syslog-ng is a frontend for viewing syslog-ng messages logged to MySQL in realtime. It features customized searches based on device, priority, date, time, and message.

Splunk, which has already been mentioned here, seems to be quite hip at the moment. You could always try the free version and decide for yourself if it's worth the cash.

share|improve this answer
Thanks, I'll take a look at php-syslog-ng. The problem with splunk, and most non free apps of this type, is that the pricing is generally way out of wack for what a K12 School District is willing and able to pay for something that doesn't add any educational value. – Ian Nov 5 '09 at 13:25
FWIW, php-syslog-ng was renamed to LogZilla a few years ago adding a new GUI and MUCH better scalability. – Clayton Dukes Sep 4 '12 at 15:08

There is a nice logging solution and analyzer called octopussy that has been mentioned on Server Fault numerous times. It is based on syslog-ng but adds a web interface and some intelligence to it.

Send the URL to a coworker and see if he's willing to click it.

Features(copied from their home page):

  • LDAP supported for Octopussy Users & Contacts
  • Send Alerts by Email, IM(Jabber), NSCA(Nagios) & Zabbix_sender
  • Export Reports by Email, FTP & SCP
  • Create Map to show your architecture (more info)
  • Input & Output Plugins for Reports (more info)
  • Reports Scheduling
  • ‘RRDTool’ to graph syslog activity
  • Lot of Services already supported: Bind, Cisco Router, Cisco Switch, DenyAll Reverse Proxy, Drbd, F5 BigIP, Fortinet FW, Ironport MailServer, Linux Kernel/System, Linux IP Tables, Monit, MySQL, Nagios, NetApp NetCache, Juniper Netscreen FW, Juniper Netscreen SM, Postfix, PostgreSQL, Samhain, Snmpd, Squid, Sshd, Syslog-ng, Windows Snare Agent, etc)
  • Wizard to easily create new Message/Service for Unrecognized logs
share|improve this answer

Splunk is the best. You can use the free version up to 500 MB a day or get the paid version. We used the free version for many months before needing the for-pay on but mileage may vary.

share|improve this answer

XLog-Solution will store all your logs in the same database and allow archiving. Dashboard is web based. They have alerts and many more.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.