1

Is there log analyzer with these features?

  • runs on Linux
  • keeps log data zip/gzip compressed
  • does not use MySQL/PostgreSQL
  • all indexing can be disabled
  • less than 100MB process size
  • supports batch mode (no need to run constantly)
  • parser for Tomcat and sshd logs
  • incremental data aggregation daily
  • multi-host data aggregation
  • generates static HTML reports
  • configurable report templates
  • has mobile friendly reports
  • uses SSH to get source logs
  • easy install and configuration (several days including reports)

I use Bash scripts to do it now, but multi-host and incremental aggregation is not there: http://whoishacking.com/#9.10

Note: I do not see daily incremental data aggregation in GoAccess. Like count lines in log file and update daily, weekly, monthly, quarterly, yearly totals in summary files. Historic reports run against smaller summary files instead of raw log files.

  • Afraid it doesn't match all your requirements (it e.g. doesn't seem to cover sshd logs – everything else can be done with piping as well), but definitely worth a look: GoAccess. Very flexible. By default, displays in your terminal – but also can generate HTML and JSON if needed (the latter would leave it to you to create "mobile friendly reports" ;). – Izzy Dec 8 '15 at 17:25
  • I do not see daily incremental data aggregation in GoAccess. Like count lines in log file and update daily, weekly, monthly, quarterly, yearly totals in summary files. Historic reports run against smaller summary files instead of raw log files. – whoishacking.com Dec 9 '15 at 0:15
  • As I wrote, doesn't match all (hence no answer). But it's incredibly fast and flexible. As for daily incrementals, that could be done via JSON and your own scripts (which then parses/joins the JSON files). Just in case nothing turns up, this might serve as fallback for a DIY solution. Good luck for a better (or even perfect) match, though – I'm aware of the deficits or I'd posted an answer ;) – Izzy Dec 9 '15 at 0:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.