Open Source Linux Logging Software

smartmontools contains utility programs (smartctl, smartd) to control/monitor storage systems using the Self-Monitoring, Analysis and Reporting Technology System (S.M.A.R.T.) built into most modern ATA and SCSI disks. It is derived from smartsuite.

Project's goal is to create better tools for diagnosing Linux systems. Diagnostics include first failure data capture, error log analysis, preventative testing, and system inventory gathering. You can now find Power System specific packages on github. libservicelog : https://github.com/power-ras/libservicelog servicelog : https://github.com/power-ras/servicelog lsvpd : https://github.com/power-ras/lsvpd libvpd : https://github.com/power-ras/libvpd ppc64-diag : https://github.com/power-ras/ppc64-diag sysfsutils is moved to github. New home for sysfsutils : https://github.com/linux-ras/sysfsutils

log4cplus is a simple to use C++ logging API providing thread-safe, flexible, and arbitrarily granular control over log management and configuration. It is modelled after the Java log4j API.

ANSI C functions and macros for flexible logging to files and other destinations. It is modeled after the Log for Java library (http://www.log4j.org), staying as close to their API as is reasonable. Intended for use in time-space critical environments

Ettercap is a multipurpose sniffer/interceptor/logger for switched LAN. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis. Development has been moved to GitHub, https://github.com/Ettercap/ettercap

A library of C++ classes for flexible logging to files (rolling), syslog, IDSA and other destinations. It is modeled after the Log for Java library (http://www.log4j.org), staying as close to their API as is reasonable. Platforms: Linux, Windows (VS2010). New: DailyRollingFileAppender

Development of this project has been moved to https://github.com/jessek/hashdeep. This site has been left for historical purposes ONLY. Please visit the GitHub site for current development. Computes the MD5, SHA-1, SHA-256, Tiger, or Whirlpool message digest for any number of files while optionally recursively digging through the directory structure. Can also match input files against lists of known hashes in a variety of formats.

Zabbix is an enterprise-class open source distributed monitoring solution designed to monitor and track performance and availability of network servers, devices and other IT resources. It supports distributed and WEB monitoring, auto-discovery, and more. An enterprise-class distributed monitoring solution for networks & apps

NSClient++ is a windows service that allows performance metrics to be gathered by Nagios (and possibly other monitoring tools). It is an attempt to create a NSClient and NRPE compatible but yet extendable performance service for windows.

Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. It is designed to be very cost effective and easy to operate. It does not index the contents of the logs, but rather a set of labels for each log stream. Unlike other logging systems, Loki is built around the idea of only indexing metadata about your logs: labels (just like Prometheus labels). Log data itself is then compressed and stored in chunks in object stores such as S3 or GCS, or even locally on the filesystem. A small index and highly compressed chunks simplifies the operation and significantly lowers the cost of Loki. Loki supports multi-tenancy so that data between tenants is completely separated. Multi-tenancy is achieved through a tenant ID (which is represented as an alphanumeric string). When multi-tenancy mode is disabled, all requests are internally given a tenant ID of “fake”.

Elasticsearch is a distributed, RESTful search and analytics engine that lets you store, search and analyze with ease at scale. It lets you perform and combine many types of searches; it scales seamlessly, and offers answers incredibly fast with search results you can rank based on a variety of factors. Elasticsearch can be used for a wide variety of use cases, from maps and metrics to site search and workplace search, and with all data types.

This small tool allows the user to graphically examine ddrescue's mapfiles in a user friendly GUI application. The Main window displays a block grid with each block's color representing the block types it contains. Many people know this type of view from defragmentation programs. The program is written in Object Pascal using the Lazarus IDE. It can be compiled to run on Windows, GNU/Linux and probably OS X, too. The downloads include binaries for the respective target platform and the project files (source code). Update 2022/02/25: ddrescueview version 0.4.5 has been released. This maintenance release restores compatibility with ddrescue 1.24 and later. Please consider testing this version. Report issues in the bug tracker if you have a sourceforge account, or by email to <mbit-kiel@users.sourceforge.net>

Logwatch is a customizable log analysis system. Logwatch parses through your system's logs and creates a report analyzing areas that you specify. Logwatch is easy to use and will work right out of the package on most systems.

syslog-ng is the log management solution that improves the performance of your SIEM solution by reducing the amount and improving the quality of data feeding your SIEM. With syslog-ng Store Box, you can find the answer. Search billions of logs in seconds using full text queries with Boolean operators to pinpoint critical logs. syslog-ng Store Box provides secure, tamper-proof storage and custom reporting to demonstrate compliance. syslog-ng can deliver data from a wide variety of sources to Hadoop, Elasticsearch, MongoDB, and Kafka as well as many others. syslog-ng flexibly routes log data from X sources to Y destinations. Instead of deploying multiple agents on hosts, organizations can unify their log data collection and management. syslog-ng Store Box provides automated archiving, tamper-proof encrypted storage, granular access controls to protect log data. The largest appliance can store up to 10TB of raw logs.

A bandwidth meter, for monitoring internet connection speeds and usage.

Untangle is a Linux-based network gateway with pluggable modules for network applications like spam blocking, web filtering, anti-virus, anti-spyware, intrusion prevention, bandwidth control, captive portal, VPN, firewall, and more. Visit http://untangle.com

File system/directory monitoring utilities with loggin and task processing support (can execute files or make a WCF service call). Multiple configuration options. Source code libraries can be used to create a custom file system monitor.

pcapsipdump is libpcap-based SIP sniffer with per-call sorting capabilities. It writes SIP/RTP sessions to disk in a same format, as "tcpdump -w", but one file per SIP session (even if there is thousands of concurrent SIP sessions). Getting started: http://pcapsipdump.sf.net/

BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system.

Logstash is a server-side data processing pipeline that dynamically ingests data from numerous sources, transforms it, and ships it to your favorite “stash” regardless of format or complexity. It supports and ingests data of all shapes, sizes and sources, dynamically transforms and prepares this data, and transports it to the output of your choice. Logstash is extensible, with over 200 plugins available to let you create and configure your pipeline how you choose.

When logging, it's important to use the least amount of resources available. Over time, logged messages tend to pile up. This can lead to some negative effects on applications, such as reduced requests per second. This is why pino is an ideal choice for logging. pino is a very fast Node.js logger with very low overhead. It is in many cases 5x faster than alternatives, based on benchmarks. pino offers not just speed but a number of great features as well, such as a browser API, child loggers, transports, and pretty printing, which "prettifies" your logs.

Screen squid is web-based interface for viewing reports based on Squid proxy server log files. It can be accessed from web-browser through more than 50 reports. No extra files, only DB. All reports generated "on-the-fly". And we got personal cabinet for each user/group.

Serial line sniffer (slsnif). slsnif is a serial port logging utility. It listens to the specified serial port and logs all data going through this port in both directions.

swatchdog.pl started out as swatch, the "simple watchdog" for activity monitoring log files produced by UNIX's syslog facility. It has since been evolving into a utility that can monitor just about any type of log. The name has been changed to satisfy a request made by the old Swiss watch company.

Osquery is an operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive. Osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.Osquery queries your devices like a database. Osquery uses basic SQL commands to leverage a relational data-model to describe a device. Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.