What open-source tool can centralize and monitor Windows and Linux logs?
Asked by
MellowPine47
I manage several virtual Windows servers running our own software, along with web servers on Windows and Debian Linux. At the moment, I have to log into each machine separately to inspect text log files, and nothing is being actively monitored. I'm looking for an open-source solution with a browser-based interface that can collect logs in one place, provide searching and statistics, and send alerts when needed. Support for Windows Event Logs, database data, and other formats would be a bonus. What tools would be worth considering?
Answers
OpenSearch with its logging and dashboard components is another open-source route. Wazuh is also worth looking at if you want security monitoring in addition to centralized logs; it is built around OpenSearch and includes collection, detection, dashboards, and alerting.
Reply to this answer
Graylog is a strong fit. It can ingest Windows Event Logs and regular text files, then lets you search, build dashboards, create statistics, and configure alerts through a web interface. It commonly uses Elasticsearch or OpenSearch as a backend, so it’s capable but not especially simple to deploy from scratch.
Reply to this answer
Splunk, QRadar, and New Relic can handle this kind of centralized monitoring, but they are commercial products and may become expensive as the amount of ingested data grows. They’re worth evaluating if you need a supported enterprise platform rather than a primarily open-source stack.
Reply to this answer
Add your answer
Answers are reviewed before publication.
BrightOtter6: The setup can definitely be a bit involved, especially when configuring the backend, but it’s still a good option once everything is running.