The Top Free Log Management Tools

Sunday, October 10, 2010

Anton Chuvakin


I completely forgot to repost my list of free log management tools to the blog from my consulting site. Here it is (original that is updated periodically):

This page lists a few popular free open-source log management and log analysis tools. 

The page is a supplement to "Critical Log Review Checklist for Security Incidents" that can be found here or as PDF or DOC (feel free to modify it for your own purposes or for internal distribution - but please keep the attribution to us authors). 

The log cheat sheet presents a checklist for reviewing critical system, network and security logs when responding to a security incident.

 It can also be used for routine periodic log review. It was authored by Dr. Anton Chuvakin and Lenny Zeltser

The open source log management tools are:

  1. OSSEC (  an open source tool for  analysis of real-time log data from Unix systems, Windows servers and network devices. It includes a set of useful default alerting rules as well as a web-based graphical user interface. This is THE tool to use, if you are starting up your log review program. It even has a book written about it.
  2. Snare agent ( and ProjectLasso remote collector ( are used to convert Windows Event Logs into syslog, a key component of any log management infrastructure today (at least until Visa/W7 log aggregation tools become mainstream).
  3. syslog-ng ( is a replacement and improvement of classic syslog service - it also has a Windows version that can be used the same way as Snare
  4. Among the somewhat dated tools, Logwatch (, Lire ( and LogSurfer ( can all still be used to summarize logs into readable reports
  5. sec ( can be used for correlating logs, even though most people will likely find OSSEC correlation a bit easier to use (or even use OSSIM below)
  6. LogHound ( and slct ( are more "research-grade" tools, that are still very useful for going thru a large pool of barely-structured log data.
  7. Log2timeline ( is a useful tool for investigative review of logs; it can create a timeline view out of raw log data.
  8. LogZilla (aka php-syslog-ng) ( is a simple PHP-based visual front-end for a syslog server to do searches, reports, etc
The next list is a list of "honorable mentions" list which includes logging tools that don't quite fit the definition above:
  • Splunk is neither free nor open source, but is has a free version usable for searching up to 500MB of log data per day - think of it as a smart search engine for logs.
  • OSSIM  is not just for logs and also includes OSSEC; it  is an open source SIEM tool and can be used much the same way as commercial Security Information and Event Management tools are used (SIEM use cases)
  • Microsoft Log Parser is a handy free tool to cut thru various Windows logs, not just Windows Event Logs. A somewhat similar tool for Windows Event log analysis is Mandiant Highlighter (
  • Sguil is not a log analysis tools, but a  network security monitoring (NSM) tool – it does use logs in its analysis.
For a list of commercial log management tools go to Security Scoreboard site. A few of the commercial tools offer free trials for up to 30 days.

Feel free to suggest your favorite tools and I will update the list!

Cross-posted from Security Warrior

Possibly Related Articles:
Tools Log Management
Post Rating I Like this!
Robb Reck Great list. Thank you for the info. Some tools on here I had never heard of.

The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.