I'd like to centralize logging for all my servers. Server operating systems include Windows 2003, 2008, Ubuntu and Redhat. I think Splunk is too expensive, has anyone set up something like this using open source or reasonably priced software. Please only answer if you have had experience using the product, I've already done a google search!

  • Please define "reasonably-priced." What's your budget?
    – mfinni
    Feb 10 '11 at 19:23
  • Let's say under $2000. Feb 10 '11 at 19:37
  • Product and service recommendations are off topic per the FAQ.
    – sysadmin1138
    Jan 29 '12 at 13:19

I use rsyslog and loganalyzer for my setup.

All logs go to a central logging file which I can view via web browser using loganalyzer.

I dug up a decent howto. I can not find the one I used when I set this up, but this should do nicely.


  • Wow, relp and native ssl support. This looks like the one. If I could award part of the answer to Dave Mackintosh for suggesting NTsyslog2 for the Windows clients, I would. Thank you both. Feb 11 '11 at 20:18

I use syslog-ng (mostly because I found it and figured it out before rsyslog became big) as my central logging server. I like it because you can easilly set up per-host targets. This makes it much easier to sort through dense logs if you only have to do it one host at a time.

You might be interested in my example syslog-ng configuration for Linux. I set up the classic "messages" and "maillog" destinations that get everything from all sources, and then each individual source gets its own collection of dated files.

For Windows sources, I use a package called NTsyslog2, which I believe came from Google Code.

To parse it all, I have a shell script which I got from somewhere and then horribly mangled to fit my own specific requirements. It reads the single-logfile which has everything in it and emails me things that I've told it to look for.

One thing I will warn you about: make sure you keep tabs on your disk space, especially if you are sending lots of Windows servers' event logs to your syslog server.

  • I've used syslog-ng in the past, that's what I was planning on using. I noticed that they have become split commercial source, sometimes that's a bad thing... Feb 11 '11 at 20:06

Take a look at the open source nxlog tool which runs on various platforms (including Windows and Linux). It can collect from EventLog, files, syslog, database etc and has a wealth of other features.


You can use Octopussy (disclaimer: my project).

It's Open Source, it's free.

You can search through your logs, generate alerts and reports... and more ! :)

  • Looks cool, I'm going to check this out! Feb 11 '11 at 20:02

You could just use a free syslog server, it usually comes with most Unices including most Linux distributions, and one of the free NT syslog agents for your Windows boxes. Without knowing your budget or any unstated requirements, that will get you centralized logging, end of sentence.

I've done this.

Do you have any other requirements, or is centralized logging all you need?

  • Right now secure centralized logging is the need. Maybe a SQL backend could be considered a soft requirement. Feb 10 '11 at 19:38
  • 1
    Define "secure". You could use IPSec to secure all syslog traffic. Why would a SQL backend be a requirement? I'm thinking of requirements in the sense of "what do you need to accomplish", not "what technology do I think will accomplish something that I may not have defined." Once it's in a SQL database, what would you be doing with it that you can't do with grep or Perl or LogParser?
    – mfinni
    Feb 10 '11 at 20:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.