2

Possible Duplicate:
Alternatives to Splunk?

I need to deploy a centralized log management device or appliance. It should be able to handle at least 100 devices giving it input. I would also like the ability for it to send me alerts when certain things are caught.

I have looked at splunk and free splunk doesn't alert you. Any other ideas? It can run on either windows or linux it doesn't matter.

Community
  • 1
ChrisMuench
  • 136
  • 1
  • 5
  • 1
    http://stackoverflow.com/questions/183977/what-commercial-and-open-source-competitors-are-there-to-splunk/ – warren Jul 21 '10 at 16:56

5 Answers5

2

Although not strictly "log management", another possibility in managing large networks of devices is a monitoring system. In many cases it's useful to know now only if a device is reporting "error" or "ok" with a service, but also if that service (and the machine it's running on) is completely inaccessible. Systems like Nagios and Zenoss (http://www.zenoss.com/) (both have open source and enterprise editions) will alert you of problems and can also parse logs to report problems that way too.

supervacuo
  • 1,403
  • 2
  • 11
  • 10
  • 1
    +1, What supervacuo is hinting at here is that logs are NOT the channel for monitoring i.e. alerting - they are diagnostic/auditing tools. – symcbean Jul 22 '10 at 12:28
  • Thanks for clarifying my spaghetti-verbiage! That's exactly what I'm trying to say — log parsing to get alerts is inserting an almost-always-unnecessary step in the process. – supervacuo Jul 22 '10 at 16:58
1

You could try syslog-ng store box appliance.

http://www.balabit.com/network-security/syslog-ng/log-server-appliance/

You could also simply do this with syslog-ng afcourse but the above is turnkey appliance.

1

Give LogZilla a try (http://www.logzilla.pro), my company has been using for a year now and I love it. It does have built-in alerting capability.

Clayton Dukes
  • 61
  • 5
0

Try CorreLog. Here is the link for the 30 day evaluation version. http://www.correlog.com/purchase/free-trial-download-form.html

Security event correlation, consolidation of logs, any platform. Check them out.

0

I have liked using Epylog:

http://packages.debian.org/sid/epylog

You can write regex to catch what you wish and then act on it. Just central syslog the data and run epylog on a schedule.