Open Source Linux Log Analysis Software

AWStats is a free powerful and featureful server logfile analyzer that shows you all your Web/Mail/FTP statistics including visits, unique visitors, pages, hits, rush hours, os, browsers, search engines, keywords, robots visits, broken links and more

ProM is the comprehensive, extensible framework for process mining. Process Mining deals with the a-posteriori analysis of (business) processes using enactment logs.

Sarg - Squid Analysis Report Generator is a tool that allow you to view "where" your users are going to on the Internet. Sarg generate HTML reports, with informations about users, IP Addresses, bytes, sites and times.

CMTrace Open is a free, open-source log viewer and troubleshooting application designed for Windows administration and endpoint management. It provides a modern alternative to Microsoft's CMTrace utility with expanded diagnostic capabilities. The software automatically recognizes multiple log formats and displays entries with severity-based color coding. Users can monitor logs in real time, search messages, filter events, and identify Windows error codes. Specialized diagnostic workspaces help analyze Microsoft Intune, Configuration Manager, and Windows Autopilot deployment issues. It also supports Windows Event Log files, device registration diagnostics, and software installation troubleshooting. Available for Windows, macOS, and Linux, CMTrace Open offers full and lightweight editions for examining system logs and investigating administrative problems.

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics dashboards and data visualization

binjr is a free, open-source time series browser designed for exploring numerical monitoring data and timestamped application logs. It provides an interactive desktop environment for visualizing information collected by external systems. Users can combine data from multiple sources into customizable charts using drag-and-drop controls. The software supports numerical time series, structured log files, and several monitoring data formats. Its navigation tools include timeline zooming, synchronized charts, detachable tabs, and browsing history. Apache Lucene indexing enables efficient searching and exploration of large log files. Users can save visualization sessions and reopen them for further investigation. Built with JavaFX for Windows, macOS, and Linux, binjr supports local data analysis without requiring cloud services.

Fluent Bit is a super-fast, lightweight, and highly scalable logging and metrics processor and forwarder. It is the preferred choice for cloud and containerized environments. A robust, lightweight, and portable architecture for high throughput with low CPU and memory usage from any data source to any destination. Proven across distributed cloud and container environments. Highly available with I/O handlers to store data for disaster recovery. Granular management of data parsing and routing. Filtering and enrichment to optimize security and minimize cost. The lightweight, asynchronous design optimizes resource usage: CPU, memory, disk I/O, network. No more OOM errors! Integration with all your technology, cloud-native services, containers, streaming processors, and data backends. Fully event-driven design leverages the operating system API for performance and reliability. All operations to collect and deliver data are asynchronous.

SSHGuard protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using several firewall backends, including iptables, ipfw, and pf.

AutoIndex is a PHP script that makes a table that lists the files in a directory, and lets users access the files and subdirectories. It includes searching, icons for each file type, an admin panel, uploads, access logging, file descriptions, and more.

DenyHosts is a python program that automatically blocks ssh attacks by adding entries to /etc/hosts.deny. DenyHosts will also inform Linux administrators about offending hosts, attacked users and suspicious logins. This project is being actively developed on GitHub (https://github.com/denyhosts)

LightSquid is a LIGHT and FAST, web based squid proxy traffic analyser . analize access.log and generate per-user & per group report.

swatchdog.pl started out as swatch, the "simple watchdog" for activity monitoring log files produced by UNIX's syslog facility. It has since been evolving into a utility that can monitor just about any type of log. The name has been changed to satisfy a request made by the old Swiss watch company.

The goal of PyTables is to enable the end user to efficiently and easily manipulate large datasets (both homogenous, i.e. arrays, and heterogenous, i.e. tables) on a persistent, hierarchical way.

Squid Analyzer parses Squid proxy access log and reports general statistics about hits, bytes, users, networks, top URLs, and top second level domains. Statistic reports are oriented toward user and bandwidth control.

This is dhcpd-pools ISC dhcp shared network and pool range usage analysis. Purpose of command is to count usage ratio of each IP range and shared network pool which ISC dhcpd is in control of. Users of the command are most likely ISPs and other organizations that have large IP space. Program is written C. Design goal is to get analysis done quickly where there is lots of data. On cheap laptop the speed of analysis is roughly 100k leases per second. Number of ranges, or shared networks, does not make any significant difference in getting analysis done.

The pimped Apache status makes the Apache server status readable, sortable and searchable. The pimped Apache status can merge the status of several servers that opens the possibility to identify the troubleshooter even in a loadbalanced website. The webbased tool offers a multilanguage, skinable interface with a built-in updater. In several views you see most requested pages, vhosts, used methods, IPs that make the most requests and more. All views are sortable tables you can filter by a keyword and are available as API Request too to get its data as CSV, XML or JSON. Compatible with PHP 7+8 (and should run on PHP 5.x - but is not supported).

Claude Code History Viewer is an offline desktop application and web interface for browsing and analyzing AI coding assistant conversations. It supports 31 development assistants, including Claude Code, Codex CLI, GitHub Copilot, Gemini CLI, Cursor, and OpenCode. Users can explore conversations organized by project, session, and worktree. A unified search engine finds messages across different AI providers. Its analytics dashboard visualizes token usage, estimated costs, and provider distribution. A session board provides timelines and visual comparisons of development activity. Real-time file monitoring automatically updates conversations as new messages appear. The application also includes message navigation, Claude Code settings management, MCP server configuration, and accessibility controls. Conversation data remains stored locally.

Screen squid is web-based interface for viewing reports based on Squid proxy server log files. It can be accessed from web-browser through more than 50 reports. No extra files, only DB. All reports generated "on-the-fly". And we got personal cabinet for each user/group.

Free-SA is logs processor and report generating tool. It can be used to control traffic usage, to evaluate conformance to the Internet access security policies, to investigate security incidents, to evaluate web server efficiency and to detect troubles with server configuration.

Scripts and tools to manage your Server.

Caudium WebServer is a single process multi-threaded webserver. It has a built-in pre-processing language and includes an easy to use web-based configuration interface.

IPCAD runs captures traffic on the specified interfaces (BPF, PCAP, divert, tee, ULOG, IPQ), and records the traffic for later retrieval and analysis. Traffic exported via RSH or NetFlow.

AfterGlow is a scripts which facilitates the process of generating link graphs from CSV input. AfterGlow is written in Perl and generates output that can be read by GraphViz, Gephi, etc. Source: https://github.com/zrlram/afterglow Tarball: http://pixlcloud.com/afterglow-2

Simple Event Correlator (SEC) is a lightweight event correlator for network management, log file monitoring, security management, fraud detection, and other tasks which involve event correlation.

lla is an LDAP Logfile Analyser , it generates statistics At this moment only NS 4.11 Logfiles have been tested. Your on your own if you want to analyse other type of Logfiles. But feel free to give feedback on your experiments and contribute patches to t