Five Log Monitoring Tools

Learn to Love the Dog

The choice of the appropriate tool massively depends on the specific requirements and your personal programming skills. None of the five candidates can replace a full-scale monitoring system, let alone an intrusion detection system. In any case, administrators need to interpret the sent system events themselves. See the "Old Comrades" box for some other alternatives.

Old Comrades

Anyone searching the Internet for other alternatives to the featured tools will automatically stumble upon a few representatives that are now obsolete. The Logdigest [6] tool works like Logcheck, but has been on ice since 2009. LogSurfer [7] is pretty similar to SwatchDog, but can also group similar events. In addition, LogSurfer is written in C and should therefore work much more quickly. However, the most recent version of the tool was released in September 2011.

Petit [8] is about the same age, but it is still in the repositories of Ubuntu. The tool uses language analysis methods to curb the flood of data, especially in system logs. This allows administrators to, for example, list all words that occur particularly frequently in a logfile. In addition, the tool draws a graph that presents the number of messages in a given period of time (Figure 9). The hash function, which keeps track of similar messages in the log, is also interesting. It allows the viewer to immediately see which errors occur most frequently.

Figure 9: As this diagram of Petit shows, a lot of events were entered in the first five minutes of the log recording.

LOGalyze provides a GUI and can also be remotely operated via your browser. However, anyone who wants to use the tool should remember the tool's age. The supplied Tomcat version also needs to be replaced as quickly as possible. Admins also need to be able to figure out for themselves how to use LOGalyze.

Logcheck can be put into operation particularly quickly. Anyone who masters regular expressions can reduce the flood of data using quickly added and customized filtering rules. While Logcheck only sends the naked events to the admin, Logwatch provides the admin with a summary. If admins want to monitor their own services using Logwatch, they need Perl scripts.

MultiTail is worthwhile for administrators who literally want to keep an eye on several logfiles and only want to trigger actions in certain cases. Sending emails and forwarding filtered events may be possible; however, to do so admins need to write suitable regular expressions and manually configure MultiTail. The tool is therefore useful as a very good supplement to Logcheck and Logwatch.

Finally, SwatchDog is comparable to Logwatch: It can be set up quickly but requires knowledge of regular expressions. Additionally, it only reports individual events specified by the administrator.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Monitoring Logfiles

    Logfiles contain records of what happens on a Linux system and the services it runs. Tools like Logcheck and Logsurfer filter out the most important events for the administrator, and they can even trigger an appropriate reaction automatically.

  • Command Line: MultiTail

    MultiTail is not only more powerful than Tail, it's also easier to use.

  • Logfile Viewers

    While users are surfing the web, listening to music, and writing documents, the kernel and various background daemons write information to logfiles. KSystemLog, Gnome System Log Viewer, and MultiTail will help you read and process logfile data.

  • A Tale of tails

    When it comes to file monitoring, tail's replacements, colortail and MultiTail, offer more sophisticated control over how your information is displayed.

  • Host-Based IDS

    A host-based intrusion detection system is a simple but powerful tool for finding traces of an attacker's footprint.

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More