I manage several virtual Windows servers running our own software, along with web servers on Windows and Debian Linux. At the moment, I have to log into each machine separately to inspect text log files, and nothing is being actively monitored. I'm looking for an open-source solution with a browser-based interface that can collect logs in one place, provide searching and statistics, and send alerts when needed. Support for Windows Event Logs, database data, and other formats would be a bonus. What tools would be worth considering?
3 Answers
Splunk, QRadar, and New Relic can handle this kind of centralized monitoring, but they are commercial products and may become expensive as the amount of ingested data grows. They’re worth evaluating if you need a supported enterprise platform rather than a primarily open-source stack.
Graylog is a strong fit. It can ingest Windows Event Logs and regular text files, then lets you search, build dashboards, create statistics, and configure alerts through a web interface. It commonly uses Elasticsearch or OpenSearch as a backend, so it’s capable but not especially simple to deploy from scratch.
OpenSearch with its logging and dashboard components is another open-source route. Wazuh is also worth looking at if you want security monitoring in addition to centralized logs; it is built around OpenSearch and includes collection, detection, dashboards, and alerting.
The setup can definitely be a bit involved, especially when configuring the backend, but it’s still a good option once everything is running.