I administer several virtual Windows servers running our own software, along with web servers on Windows and Debian. Right now, checking logs means signing into each machine individually, and nothing is actively monitoring them. I'm looking for an open-source solution with a central web interface for collecting and searching text logs and Windows Event Logs, ideally with dashboards, statistics, monitoring, and alerting. Support for database or other structured log sources would be a bonus. What tools would you recommend, and how difficult are they to set up?
4 Answers
Wazuh is worth considering if security monitoring is important too. It presents itself primarily as an SIEM, but it is built around OpenSearch and includes log collection, dashboards, rules, and alerting out of the box. It may be more security-focused than you need, but it can cover centralized monitoring well.
Graylog is a strong fit. It can collect Windows Event Logs and regular text logs, then gives you centralized searches, dashboards, and alerting through a web interface. The main downside is that the initial setup is fairly involved, especially if you’re building the whole stack yourself.
Commercial options such as Splunk, QRadar, or New Relic can handle this, but they generally come with licensing costs. They’re polished and capable, though for an open-source-first setup I’d start by evaluating Graylog, OpenSearch, or Wazuh.
OpenSearch or the broader Elasticsearch-style stack is another common route. It’s flexible and works well for dashboards, analysis, and alerting, but there are several components to configure and maintain, so it may be more infrastructure than you need for a small deployment.
That sounds useful, although I was hoping for something relatively simple to get running. I’ll compare the setup requirements with Graylog.