0

Does anybody know of a good tool to collect and analyse the application logs from a number of different Windows servers running on VMWare? All servers are on the same domain.

Ideally the tool would be free and open source.

Thanks

5 Answers 5

2

Splunk is the new hot player on the market. It's a sorta-free model. A single server is free, but if you want to correlate multiple servers logs into a single server you need to pay.

Zenoss has a much less robust log aggregator, but it works, and you can do many other things with Zenoss as well. Zenoss operates under a sorta-free model as well, but there is no limit on the free version, only a few missing features.

FWIW, I would pay for splunk. It's that good

2
  • Splunk is extremely expensive. LogZilla will do the same thing for far less money and scales extremely well. (also has a much easier interface). Jun 27, 2012 at 15:14
  • And now there's logstash as well. Jul 19, 2012 at 9:30
2

I use a combination of SyslogD, snare and Splunk for my log analysis. SNARE sits on the windows server and pipes the eventlogs to my central syslogd logging server (which is also my Nagios server)

I then use Splunk to analyse them on the one server only, abiding by (in my eyes at least) the server license.

I have posted semi-instructions on how to do this on my blog at Central Syslog for Servers

This also takes care of my Pix's and other equipment that can redirect their logging.

0

Here are some instructions on setting up snare and splunk: http://www.splunk.com/base/Documentation/2.1/Admin/Snare

0

Microsoft EvenComb. Down and dirty does a nice job.

1
  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – Scott Pack
    Dec 5, 2012 at 16:11
0

We have NXLog Community Edition in my company (I work here) that can collect, parse, convert and send Windows EventLog as well as other Windows log sources (Windows DNS, PowerShell, Windows Firewall, etc). If you are working with SIEM like Rapid7, IBM QRadar, etc there is the option to use NXLog as the log source to send events to these SIEM suites. There are also integrations with Splunk, Snare, Graylog, ELK stack etc.

You must log in to answer this question.