Syslog is the keeper of all things events and we’re bringing you the Best Free Syslog Servers for Windows (and Linux), along with some insightful reviews and screenshots. Syslog (System Logging) standard is widely used by devices of all sorts, including computers, routers, switches, printers, and more. Devices send syslog messages about any number of events. These can be informational messages, such as user login events, or they can be critical messages, like a failure in the primary application. These messages play an important part in a network administrator’s arsenal of tools; they alert the admin of errors and warnings right as they happen, allowing them to quickly respond to problems and hopefully fix them before they become major issues. Syslog messages are also important to have for security audits.
On a network with a large number of devices, accessing logs on each device requires logging in to each one. It is a tedious and time-consuming process and you run the risk of missing important event messages. This is where syslog servers, also referred to as collectors, become very useful. After enabling each device to send syslog messages, those devices start sending their log messages which are captured by the syslog server; there they are readily available to view and analyze.
Unlike SNMP, syslog cannot be used to poll devices for information; the syslog standard is used only to send messages about events. For troubleshooting purposes, syslog sending is potentially more effective than SNMP polling because syslog messages are sent and received immediately after an event occurs. Polling information is received at intervals – events can occur quickly and cause a lot of damage in the short amount of time between polling intervals.
For each device that you wish to have send its event logs to your syslog server, you need to ensure that its remote -syslog service is enabled and that it is pointed at the IP address of your server. Take note that Syslog uses UDP port 514; each sending device and the receiving Syslog collector need to be able to access this port. Grab one of the following Free Syslog Servers below to keep an eye on your network with further detail from a centralized location.
Kiwi Syslog Server Free Edition by SolarWinds – Get it HERE
Created by the industry-leading network management software developer SolarWinds, Kiwi Syslog Server is a comprehensive logging tool that collects syslog events and messages not only from network devices, but also Linux, Unix, and Windows systems. Using Kiwi’s GUI, you can easily and efficiently view and manage these log events from one console.
The free edition lets you collect and monitor syslog messages from up to 5 devices and lets you set up alerts for events such as heavy traffic, unauthorized login attempt, hardware failure, and more.
Kiwi also creates trend graphics, such as network traffic trends, and also creates a daily summary email for you. Finally, you can archive all these syslog messages as well as forward them to a database or other syslog systems. The full version of Kiwi Syslog Server allows you to set up actions, such as run program or play sound, that are triggered by certain log events; it also comes with a web-based interface that lets you manage the syslog server remotely.
SnmpSoft Syslog Watcher
A comprehensive, feature-rich application, Syslog Watcher from SnmpSoft is a Windows-based dedicated syslog server that collects and analyzes syslogs from any number of network hosts and servers. (The free version allows up to 5 sources, while the professional license lets you collect from an unlimited number of sources.) It gathers syslog messages from any device or appliance that has syslog sending enabled, as well as system log events from Windows, Unix, and Linux servers. It also collects from any software that supports syslog sending. It boasts being able to handle 5000+ syslog messages per second.
Syslog Watcher supports both IPv4 and IPv6 networks, and collects over both UDP & TCP. You can enable email alerts for certain events and messages, which alerts you of network and system errors before they become major problems. The Viewer lets you sort and filter events as they come in, and lets you view the most recent syslogs in virtually real-time; messages can be customized by font and background based on filters. All stored messages can be searched using an extensive rule set. Important messages can be saved longer, and max keep time depends on the severity level of the message. Syslog Watcher comes with extensive export options, including exporting to a database and manual and auto export.
Paessler PRTG Syslog
Syslog server functionality is built into the PRTG Network Monitor application, which we discussed in our previous article about netflow collectors. PRTG is a full-featured network monitoring and management application that does not require additional software installation to activate the syslog server functionality. The Syslog Receiver sensor can be added via the “add sensor” dialog (PRTG uses “sensors” to monitor and analyze network traffic). It receives and processes syslog messages from network devices as well as Windows machines. PRTG boasts handling a very high number of syslog messages per second (up to 10,000 in a lab setting); however, your capabilities will depend on your processing power, storage, and configuration.
Syslog events can be viewed and analyzed using the web interface. Information is displayed in an easy-to-understand interface and messages can be filtered according to type of message, severity, and more. The filters can then be further refined to exclude or include messages, and categorize them as warnings or errors. Alert triggers can be set up for specific types of messages, such as warnings or errors; you can also create an alert for when a high number of messages per second start coming in. The freeware version of PRTG allows for up to 100 sensors.
Splunk Light is designed to be a comprehensive log management solution for small IT environments. Real time analysis of syslog messages from your devices is done from its customizable dashboard. It comes with powerful search functionalities and the ability to filter results and drill down to those messages that you specifically require, such as error messages only or messages only from a specific device. Its search capabilities include Boolean, quoted string and wildcard searches; it allows you to search in real time, search time-range, or search by transaction-level. Splunk’s capabilities can be expanded using add-ons such as the Add-on for Microsoft Windows, which allows you to collect log messages from Windows machines. It can also be set up to collect syslog data from a forwarder. The Splunk Light free tool allows for up to 500MB of data capture per day.
In a previous article, “Top 10 Free Netflow Analyzers and Collectors,” we discussed the application The Dude, from MicroTik. The Dude is a powerful network administration application; it contains within itself a built-in Free Syslog Server. This server can be turned on in the Server settings, under the “Syslog” tab. While having The Dude poll your devices (sending out information requests at regular intervals using SNMP) is useful, capturing unsolicited messages from your devices is a more effective way to catch errors quickly. You can create alerts for specific syslog messages as well as create filters. The Dude is a great all-purpose application for network administrators.
WhatsUp Syslog Server Free Tool
This simple yet useful tool allows you to easily collect, view, and forward syslog events from devices anywhere on your network. With Syslog Server you can view the messages in real time with a simple and intuitive user interface that allows you to analyze and interpret syslog messages as they come in. The filter function lets you customize which data you want to view. It boasts expanded export capabilities, such as text, CSV, and many more, as well as forwarding event logs to other syslog servers. Custom alerts notify you of errors and warnings. WhatsUp Syslog Server Free Tool is a worthwhile tool for any admin.
Grab one of these great Free Syslog Servers today and fire up a Test VM or Server and get it configured to really get a good feeling of the software works, along with their respective feature sets.