Open Source Log Analysis Software

AWStats is a free powerful and featureful server logfile analyzer that shows you all your Web/Mail/FTP statistics including visits, unique visitors, pages, hits, rush hours, os, browsers, search engines, keywords, robots visits, broken links and more

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics dashboards and data visualization

IPCAD runs captures traffic on the specified interfaces (BPF, PCAP, divert, tee, ULOG, IPQ), and records the traffic for later retrieval and analysis. Traffic exported via RSH or NetFlow.

AfterGlow is a scripts which facilitates the process of generating link graphs from CSV input. AfterGlow is written in Perl and generates output that can be read by GraphViz, Gephi, etc. Source: https://github.com/zrlram/afterglow Tarball: http://pixlcloud.com/afterglow-2

Simple Event Correlator (SEC) is a lightweight event correlator for network management, log file monitoring, security management, fraud detection, and other tasks which involve event correlation.

Textual data processing solution for system administrators and Web programmers. The C library allows to manipulate string lists, CGI forms, MIME data, configuration files, logs parsing, regular expressions, date/time parsing, templates rewriting etc.

A powerfull tool for analysing application servers logs (websphere, websphere portal, j2ee, custom) in a cluster (or not). It can analyse any log format thanks to a parser plugin approache. You can easily develop your own parser in java (for jboss, bea,.

ttyrpld is a multi-OS kernel-level TTY keylogger and screenlogger with (a)synchronous replay support. It runs on Linux, Solaris, FreeBSD, NetBSD and OpenBSD.

FAST library for storing and displaying various types of statistics. Rock stable and robust and well-designed image output.

JarCon, previously known as \"Joe@Rcon\", is a complete remote Half-Life: Counter-Strike server connection tool. It can be used by server administrators to remotely monitor and control their server(s), with full log-parsing.

Web analyzer for logs from different formats, which output XML reports, multi-hosts logs file supported, possibility to apply an XSL page to ouput in HTML, and use of SVG to make the graphs. The project includes the library to parse HTTP_USER_AGENT

Java and ColdFusion libraries to lookup country code and language from IP address. It uses a local copy of the WHOIS database to perform fast, accurate lookups of country codes. Useful for log analysis, internationalization, geolocation, etc..

Develop cross-platform tools faster using a C++ Framework proven in commercial software. Classes support logging, sockets, RFC servers (NNTP, SMTP, POP, HTTP), object indexing, ini, tagged databases, file systems, and more. The STDNOJ Namespace, by R.A. Nagy

SiteFinder looks through mIRC logs and extracts addresses of private FTP sites from users' advertisements. Then those addresses are exported to HTML, GetRight or Net Vampire (download agents). Users say that "it rocks".

Vistigator is a website analyzer, which allows CEO's, CTO's, and users to view info about their website. Vistigator is integrated with Apache 2 HTTP Server, allowing Vistigator to display website stats graphically & easily about specific IP Addresses.

phpMyVisites is a Web traffic analyzer with very detailed reports and advanced graphics. It is not an Apache log analysis tool. phpMyVisites creates its own logs, and it allows access to more complete statistics. phpMyVisites provides information about v

serverM is an extremely flexible signature-based host-based intrusion detection system (HIDS). Running as a Perl daemon, it uses little CPU, and is capable of detecting a wide range of intrusions. Signature language is powerful and alarm options varied.