Open Source Linux Log Management Tools
Sort By:
Log Management Tools for Linux
View 30 business solutionsBrowse free open source Log Management tools and projects for Linux below. Use the toggles on the left to filter open source Log Management tools by OS, license, language, programming language, and project status.
-
MongoDB Atlas runs apps anywhereMongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.
-
Build Agents and Models on One PlatformGemini Enterprise Agent Platform is Google Cloud's comprehensive platform for developers to build, scale, govern, and optimize agents and models. Choose from Google's most advanced models and third-party models like Anthropic's Claude Model Family.
-
1
log4cplus
Logging Framework for C++
log4cplus is a simple to use C++ logging API providing thread-safe, flexible, and arbitrarily granular control over log management and configuration. It is modelled after the Java log4j API. -
2
l'oGGo
A powerful terminal app for structured log streaming
l'oGGo or Log & Go is a rich Terminal User Interface app written in Golang that harnesses the power of your terminal to digest log streams based on JSON-based logs. This can be used against applications running locally, on a Kubernetes cluster (see K8S Cheatsheet), GCP Stack Driver (Google Logs, see GCP-Stream Command), and many others. -
3
PM2
Node.js Production Process Manager with a built-in Load Balancer
PM2 (Process Manager 2) is a production process manager with its own built-in load-balancer for Node.js applications. If you want battle-hardened Node.js applications that can be monitored and kept alive forever, PM2 is the way to go. PM2 lets you manage, maintain and increase Node.js performance. It is constantly assailed by over 1800 tests so you can deliver high quality applications, and deploy confidently and more often. PM2 is cross-platform and arguably the most widely-used process manager for Node.js with over 100 million downloads. Setting it up is easy, it just takes a couple of minutes and one simple command. -
4
syslog-ng
Log management solution that improves the performance of SIEM
syslog-ng is the log management solution that improves the performance of your SIEM solution by reducing the amount and improving the quality of data feeding your SIEM. With syslog-ng Store Box, you can find the answer. Search billions of logs in seconds using full text queries with Boolean operators to pinpoint critical logs. syslog-ng Store Box provides secure, tamper-proof storage and custom reporting to demonstrate compliance. syslog-ng can deliver data from a wide variety of sources to Hadoop, Elasticsearch, MongoDB, and Kafka as well as many others. syslog-ng flexibly routes log data from X sources to Y destinations. Instead of deploying multiple agents on hosts, organizations can unify their log data collection and management. syslog-ng Store Box provides automated archiving, tamper-proof encrypted storage, granular access controls to protect log data. The largest appliance can store up to 10TB of raw logs. -
$300 Free Credits to Build on Google CloudPut your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.
-
5
Security Onion
Linux distro for threat hunting, enterprise security monitoring
Our latest version focuses on simplifying grid installation and configuration. Our products include both the Security Onion software and specialized hardware appliances that are built and tested to run Security Onion. Our appliances will save you and your team time and resources, allowing you to focus on keeping your organization secure. We offer both training and support for Security Onion. Our instructors are the only Security Onion Certified Instructors in the world and our course material is the only authorized training material for Security Onion. We've been teaching Security Onion classes and providing Professional Services since 2014. -
6
AlienVault OSSIM
Open Source SIEM
OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics dashboards and data visualization -
7
Rhit
A nginx log explorer
Rhit is a fast Rust command-line explorer for analyzing Nginx access logs directly in the terminal. It reads standard log files from their usual locations and can process compressed logs without requiring a separate database. Results are summarized in compact console tables rather than stored in another analytics system. Users can filter requests by dates, HTTP status codes, referring pages, and request paths. Trend analysis helps reveal how traffic patterns change across a selected time period. Its performance is designed for interactive investigation, allowing repeated queries against millions of log lines. Rhit is useful for administrators who want quick traffic insights without installing a larger observability stack. -
8
OpenObserve
Elasticsearch/Splunk/Datadog alternative for (logs, metrics, traces)
OpenObserve is a cloud-native observability platform built specifically for logs, metrics, traces, and analytics designed to work at a petabyte scale. It is very simple and easy to operate as opposed to Elasticsearch which requires a couple of dozen knobs to understand and tune which you can get up and running in under 2 minutes. It is a drop-in replacement for Elasticsearch if you are just ingesting data using APIs and searching using Kibana (Kibana is not supported nor required with OpenObserve. OpenObserve provides its own UI which does not require separate installation unlike Kibana). You can reduce your log storage costs by ~140x compared to Elasticsearch by using OpenObserve. Below are the results when we pushed logs from our production Kubernetes cluster to Elasticsearch and OpenObserve using fluent bit. OpenObserve stored data in Amazon s3 and Elasticsearch stored data on Amazon EBS volumes. -
9
Grafana Mimir
Grafana Mimir provides long-term storage for Prometheus
Grafana Mimir is an open-source, horizontally scalable, long-term storage solution for Prometheus metrics. Built by Grafana Labs, Mimir is designed to handle massive volumes of time-series data efficiently while maintaining high availability and reliability. It enables organizations to scale their Prometheus infrastructure without the typical limitations of single-server setups. Mimir is used to power Grafana Cloud Metrics and is built to be fully compatible with Prometheus, allowing easy integration into existing monitoring workflows. -
Demo Series - Small Business Backup By VeeamWatch this on-demand demo series and learn how to protect your Microsoft 365 data with clear, simple, actionable steps that are easy to implement for businesses of all sizes.
-
10
HyperDX
An open source observability platform unifying session replays & logs
HyperDX helps engineers figure out why production is broken faster by centralizing and correlating logs, metrics, traces, exceptions and session replays in one place. An open-source and developer-friendly alternative to Datadog and New Relic. The HyperDX stack ingests, stores, and searches/graphs your telemetry data. After standing up the Docker Compose stack, you'll want to instrument your app to send data over to HyperDX. -
11
UTMStack
Customizable SIEM and XDR powered by Real-Time correlation
Welcome to the UTMStack open-source project! UTMStack is a unified threat management platform that merges SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) technologies. Our unique approach allows real-time correlation of log data, threat intelligence, and malware activity patterns from multiple sources, enabling the identification and halting of complex threats that use stealthy techniques. UTMStack stands out in threat prevention by surpassing the boundaries of traditional systems. Our software platform can swiftly analyze log data to identify and halt threats at their source in real-time, even if the threat was not directly detected on the server itself. This seamless integration of SIEM and XDR capabilities sets UTMStack apart from competitors, providing organizations with an effective, holistic cybersecurity suite that enhances threat detection, response, and remediation across clients’ valuable digital infrastructure. -
12
DTail
DTail is a distributed DevOps tool for tailing, grepping, catting logs
DTail (a distributed tail program) is a DevOps tool for engineers programmed in Google Go for following (tailing), catting and grepping (including gzip and zstd decompression support) log files on many machines concurrently. An advanced feature of DTail is to execute distributed MapReduce aggregations across many devices. For secure authorization and transport encryption, the SSH protocol is used. Furthermore, DTail respects the UNIX file system permission model (traditional on all Linux/UNIX variants and also ACLs on Linux based operating systems). The DTail binary operates in either client or server mode. The DTail server must be installed on all server boxes involved. The DTail client (possibly running on a regular Laptop) is used interactively to connect to the servers concurrently. That currently scales to multiple thousands of servers per client. Furthermore, DTail can be operated in a serverless mode too. Read more about it in the documentation. -
13
Qualitis
Qualitis is a one-stop data quality management platform
Qualitis is a data quality management platform that supports quality verification, notification, and management for various datasource. It is used to solve various data quality problems caused by data processing. Based on Spring Boot, Qualitis submits quality model task to Linkis platform. It provides functions such as data quality model construction, data quality model execution, data quality verification, reports of data quality generation and so on. At the same time, Qualitis provides enterprise-level features of financial-level resource isolation, management and access control. It is also guaranteed working well under high-concurrency, high-performance and high-availability scenarios. -
14
Octopussy: Log Management Solution
Log Management Solution
Logs Analyzer, Alerter & Reporter with a Web Interface -
15
C++ Log Engine Library
Easy, flexible, lightweight, platform independent C++logging library
New version 1.03 is released! Check it out. LogEngine is a C++ library for easy and flexible logging to files. Multithreaded, easy to use and fast. Automatic logfile backup (several modes). A small amount of code. Platform Independent. -
16
WTERP
Factional modular: CRM, SD,MM,WM,HR, Workflo and System configuration.
WTERP is totally free software and It is very suitable for small business management. Which is developed by C#/.net. IIS WebService and SQL Server Community version of the free environment and Database at WinForm-based application framework, including server Web Service, main program framework, organizational structure, authority control, menu navigation, basic data, system parameters, log management, timing tasks, etc.WTERP includes enterprise CRM, SD, MM, WM, OA, HR, Workflow, and other information systems, and aims to help users enhance their management. -
17
-
18
apache-logs-to-mysql
Apache Log Parser and Data Normalization Application
Apache Log Parser and Data Normalization Application Python handles File Processing & MySQL handles Data Processing ApacheLogs2MySQL consists of two Python Modules & one MySQL Schema to automate importing Access & Error files and normalizing data into database designed for reports & data analysis. Runs on Windows, Linux and MacOS & tested with MySQL versions 8.0.39, 8.4.3, 9.0.0 & 9.1.0. 4 LogFormats & 2 ErrorLogFormats can be loaded and 5 MySQL Stored Procedures can be processed in a single Python `ProcessLogs function` execution. Database system designed to accommodate unlimited domains. Step-by-step guide for easy installation. Web interface with Drill Down Capability and apache/echarts Log Visualization integration in development. MySQL apache_logs schema currently has 49 Tables, 853 Columns, 168 Indexes, 66 Views, 7 Stored Procedures and 43 Functions to process Apache Access log in 4 formats & Apache Error log in 2 formats. Database normalization at work! -
19
Docker-ELK
The Elastic stack (ELK) powered by Docker and Compose
A turnkey Docker Compose stack to spin up the ELK stack (Elasticsearch, Logstash, Kibana) for log collection, analysis, and visualization. Based on official Elastic images and enhanced with configuration defaults optimized for local development and testing. -
20
Flog
A fake log generator for common log formats
flog is a fake log generator built in Go that produces realistic log entries in several common formats, including Apache common, Apache combined, Apache error, RFC3164, RFC5424, and JSON. It was created to help developers and operators test systems that consume log data, such as log pipelines, SIEMs, or streaming platforms like Amazon Kinesis. Users can control the output by specifying the log format, output file path, log type (stdout, plain log file, or gzip-compressed file), and either the number of lines or the total byte size of logs to generate. Additional options let you simulate timing behavior by configuring creation intervals and generation delays, as well as splitting output into multiple files based on line count or file size. The tool can run in a loop to continuously emit logs until terminated, making it suitable for soak testing or stress testing log ingestion services. -
21
Graylog Ansible Role
Ansible role which installs and configures Graylog
Ansible role which installs and configures Graylog. -
22
LogDNA Agent
LogDNA Agent streams from log files to your LogDNA account
LogDNA Agent streams from log files to your LogDNA account. Works with Linux, Windows, and macOS Servers. -
23
LogSearcher
Log Management Web Application
Log Searcher provided full indexed search engine for log files on each servers. It supported many powerful query types such as phrase queries, wildcard queries, proximity queries, range queries and more with Lucene and Solr technology. It comes with Web interface to search and generate chart accordingly. This project is Open Source project with Apache 2.0 license for allowing you to extra development on top of Log Searcher project. The initial configuration was written on readme.txt before implementation on production line. If you have idea for improvement, you can drop an email to me. Contact: log.searcher[at]yahoo.com -
24
Logagent
Extensible log shipper with input/output plugins, buffering, etc.
Logagent is a modern, open-source, lightweight log shipper. It is like Filebeat and Logstash in one, without the JVM memory footprint. It comes with out-of-the-box and extensible log parsing, on-disk buffering, secure transport, and bulk indexing to Elasticsearch, Sematext Logs, and other destinations. Its low memory footprint and low CPU overhead make it suitable for deploying on edge nodes and devices, while its ability to parse and structure logs makes it a great Logstash alternative. -
25
NXLog
A multi-platform universal log collector and forwarder
NXLog is a modular, multi-threaded, high-performance log management solution with multi-platform support. In concept it is similar to syslog-ng or rsyslog but is not limited to unix/syslog only. It can collect logs from files in various formats, receive logs from the network remotely over UDP, TCP or TLS/SSL . It supports platform specific sources such as the Windows Eventlog, Linux kernel logs, Android logs, local syslog etc. Writing and reading logs to/from databases is also supported. The collected logs can be stored into files, databases or forwarded to a remote log server using various protocols. The old BSD Syslog and the newer IETF syslog standard is fully supported by NXLog in addition to Snare, XML, JSON, GELF, KVP, CSV and custom formats. A key concept in NXLog is to be able to handle and preserve structured logs. No need to convert everything to syslog and parse these logs again at the other side. It has powerful message filtering, log rewrite and conversion capabilities.
