Log centralisation / mining

[rbtux]

Does anybody know a log centralisation / log mining solution comparable to splunk but opensource?

What do other users use?

[BeNe]

Maybe you can use syslog-ng that comes with must Distris.
But long not so nice and rich on features like splunk.

Greez BeNe

[rbtux]

i really like the search engine of splunk... I think I'll use splunk as it's free until 500m/day... that should be enough for the moment...

[ephigenie]

eventually you can try to use mod_log_spread
or use mod_log_sql ...

but sql loggin should be on a dedicated server for big environments as databases can grow quick to several gb.
Impact on performance is around 1-2% . Modlogan is able to generate stats directly out of the db. Otherwise you can use a pipe with mysql client to feed awstats via stdin...

mod_log_spread is best for cluster environments.

[rbtux]

thanks malte

i'll check this one out...