Open Source Log Analysis Software

Shorten your time of reading mega bytes of log files! DE 2016-01 Supporting Don HO's NotePad++ see http://notepad-plus-plus.org/ This sources are a dockable pattern search plugin for Notepad++ version 5.1 or later. With this plugin you can search for multiple patterns in any of the opened documents in NotePad++. You may want to tune your search using all fancy tricks from NPP like regular expressions or escaped patterns and give each of the searches different colors. The result will be stored in a dockable window in same ordering as in the origin and a double click allows you to jump to the original position. It is designed to treat log-files of typical size like 60MB. More features can be found in the help dialogue of the plugin. For generating the dll file I use a msdev compiler. If you like to port it to other OSs just let me know your changes and I'll incorporate it. Best Regards, Mattes H.

Visual Syslog Server for Windows is a free open source program to receive and view syslog messages. Useful when setting up routers and systems based on Unix/Linux. Visual Syslog Server for Windows has a live messages view: switches to a new received message. Helpful color highlighting. Useful message filtering. Customizable notification and actions. Sources hosted on the GitHub: https://github.com/MaxBelkov/visualsyslog

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics dashboards and data visualization

The pimped Apache status makes the Apache server status readable, sortable and searchable. The pimped Apache status can merge the status of several servers that opens the possibility to identify the troubleshooter even in a loadbalanced website. The webbased tool offers a multilanguage, skinable interface with a built-in updater. In several views you see most requested pages, vhosts, used methods, IPs that make the most requests and more. All views are sortable tables you can filter by a keyword and are available as API Request too to get its data as CSV, XML or JSON. Compatible with PHP 7+8 (and should run on PHP 5.x - but is not supported).

LightSquid is a LIGHT and FAST, web based squid proxy traffic analyser . analize access.log and generate per-user & per group report.

SSHGuard protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using several firewall backends, including iptables, ipfw, and pf.

Screen squid is web-based interface for viewing reports based on Squid proxy server log files. It can be accessed from web-browser through more than 50 reports. No extra files, only DB. All reports generated "on-the-fly". And we got personal cabinet for each user/group.

swatchdog.pl started out as swatch, the "simple watchdog" for activity monitoring log files produced by UNIX's syslog facility. It has since been evolving into a utility that can monitor just about any type of log. The name has been changed to satisfy a request made by the old Swiss watch company.

DenyHosts is a python program that automatically blocks ssh attacks by adding entries to /etc/hosts.deny. DenyHosts will also inform Linux administrators about offending hosts, attacked users and suspicious logins. This project is being actively developed on GitHub (https://github.com/denyhosts)

Fluent Bit is a super-fast, lightweight, and highly scalable logging and metrics processor and forwarder. It is the preferred choice for cloud and containerized environments. A robust, lightweight, and portable architecture for high throughput with low CPU and memory usage from any data source to any destination. Proven across distributed cloud and container environments. Highly available with I/O handlers to store data for disaster recovery. Granular management of data parsing and routing. Filtering and enrichment to optimize security and minimize cost. The lightweight, asynchronous design optimizes resource usage: CPU, memory, disk I/O, network. No more OOM errors! Integration with all your technology, cloud-native services, containers, streaming processors, and data backends. Fully event-driven design leverages the operating system API for performance and reliability. All operations to collect and deliver data are asynchronous.

AutoIndex is a PHP script that makes a table that lists the files in a directory, and lets users access the files and subdirectories. It includes searching, icons for each file type, an admin panel, uploads, access logging, file descriptions, and more.

[ set status to abandon - volunteers welcome ] The postfix-logwatch / amavis-logwatch log analyzers produce summaries, reports and statistics regarding the operation of postfix and amavis. Use standalone, or as a filter module for the open source logwatch utility.

this tool tries to repair your broken pcap and pcapng files by fixing the global header respectively packet blocks and recovering the packets by searching und guessing the packet headers or blocks

Scripts and tools to manage your Server.

IPCAD runs captures traffic on the specified interfaces (BPF, PCAP, divert, tee, ULOG, IPQ), and records the traffic for later retrieval and analysis. Traffic exported via RSH or NetFlow.

lla is an LDAP Logfile Analyser , it generates statistics At this moment only NS 4.11 Logfiles have been tested. Your on your own if you want to analyse other type of Logfiles. But feel free to give feedback on your experiments and contribute patches to t

Simple Event Correlator (SEC) is a lightweight event correlator for network management, log file monitoring, security management, fraud detection, and other tasks which involve event correlation.

Logs Analyzer, Alerter & Reporter with a Web Interface

HoneyVIew ist a tool to analyze honeyd-logfiles of the honeyd-daemon implemented by Niels Provos in an convenient way. HoneyView generates graphical and textual results from queries against the logfile data.

ParserCap is a visual tool for information security specialists, system administrators, students and everyone who needs to analyze network traffic in PCAP format (libpcap — ETHERNET and IEEE 802.11). It is also possible to set filters for identifier search TCP headers (Documents, Multimedia, Files, Logins, Passwords etc.). If necessary, it is possible to view detailed statistics on every MAC address, including COOKIES, USER-AGENTS, HTTP GET/POST and a lot more. Please visit forum - if you have any idea :-) Last version my program you can search in my home web page! Thanks!

GoAccess is a real-time Apache web log analyzer and interactive viewer that runs in a terminal and provides fast and valuable HTTP statistics for system administrators that require a visual report on the fly.

NeoLogger is Windows Syslog Client similar to the logger command known from UNIX/LINUX systems used to send SYSLOG messages. It adds some usefull features to filter and replace content, reads from standard input, files or the windows eventlog. It is also able to watch a file or an eventlog for changes and transmits only the new entries. Logit is an additional tool, that logs process or batch output to a log file or windows Eventlog using predefined prefixes and timestamps. (see the screenshots for an Overview) Please donate some (micro-)bitcoins to my address if you saved time and money by using this free project: 1FvGzQvT3tcN47fxdaNjDeSFU6pAUsqMbn

SRG is a log file analyser and report generator for the Squid web proxy. It is fast and was created to allow easy integration with other authentication systems. SRG is flexible and can report right down the the level of individual files requested.

With the Log Parser one can scan logs, whitelist out legitimate, non-corrupt entries (usually file paths), and apply a standard format to a log generated by any antivirus or malware-removal program. This makes for easier reading of the meat in any log.

Logpp is a tool for preprocessing event logs and feeding relevant data to other programs for storing or in-depth analysis. Logpp reads lines appended to input files, matches the lines with patterns, and writes the results to given destinations.