What's the best centralized syslog viewing tool for *nix out there

Question

Looking for what people think are the best for doing web viewing of a centralized syslog server. I am open to using any syslog server also.

EDIT

I actually went with GrayLog2

splunk maybe need more characters – tony roth Mar 04 '11 at 23:09 — tony roth, Mar 04 '11 at 23:09

score 7 · Answer 1 · answered Mar 04 '11 at 23:24

7

I like Splunk myself, not cheap though.

answered Mar 04 '11 at 23:24

Chopper3

score 4 · Accepted Answer · answered Mar 04 '11 at 23:12

4

I'm using Loganalyzer with rsyslog, and it seems to work ok. The web frontend's a bit clunky, but does the job.

answered Mar 04 '11 at 23:12

growse

score 2 · Answer 3 · answered Mar 05 '11 at 03:26

2

Not tried it, but logstash sounds like it will do what you want:

The license is New BSD.

answered Mar 05 '11 at 03:26

Eureka Ikara

Logstash is also nice in combination with Graylog2. Logstash to collect and prepare events and logs, and Graylog2 to search through the collected logs. Logwatch can now be found at http://logstash.net/ – Martijn Heemels Sep 04 '11 at 01:07

3 Answers3