The best free Syslog servers to manage your logs

Syslog messages circulate around your network and provide valuable information for system monitoring. You don't have to pay anything for this information if you use a free Syslog server.

The Syslog message format is used by many applications and it is particularly associated with the Linux operating system and the software that runs on it. Microsoft created the Eventlog format for Windows and that protocol can also be used by the software packages that run on PCs. These two log message formats dominate IT operations, but many businesses ignore them.

Here is our list of the best free Syslog servers:

1. SolarWinds Kiwi Syslog Server (FREE TOOL): Collects, displays, and stores Syslog messages and SNMP traps. It is free for up to five nodes. Download the free tool.
2. ManageEngine Event Log Analyzer (FREE EDITION): Processes logs from many sources, including Syslog, but is limited to collecting from five computers. Offered as a SaaS platform or for download onto Windows Server or Linux. Download a 30-day free trial.
3. Paessler PRTG Network Monitor (FREE TRIAL): Syslog receiver that will also provide analysis on throughput by source. The full package also provides system discovery and full-stack observability. The free package gives you 100 sensors. Runs on Windows Server. Download 30-day free trial.
4. Logstash: A popular log processor that is part of the ELK stack and will receive, file, and forward Syslog messages. Runs on Linux.
5. Loggly Lite: This is the free edition of the Loggly cloud-based log management system. It will collect logs from many sources, including Syslog.
6. Logz.io Log Management Community Edition: This free package is a cloud-hosted version of Logstash and is offered for free alongside the platform’s paid editions.
7. Sematext Logs Basic Edition: This cloud-hosted system is part of a hosted ELK service and is the free edition for the log management module.

Collecting log messages

The Syslog and Eventlog formats are incompatible. Being able to search through all log messages together provides system-wide insights into IT efficiency and the activity on a computer. They are the main source of information used by SIEM tools. So, Syslog messages provide insights into system security as well as performance. 

Some performance monitors and many security scanning systems rely on log messages for their source data. These monitors operate as a series of searches that are automatically applied to incoming messages. They can only work effectively if they gather all of the log messages that are generated by software and operating systems. 

A Syslog server will only collect messages in the Syslog format but it is possible to change other formats into the Syslog layout before sending them to a Syslog server; this is called “conversion.” The other option is to set up a non-specific TFTP server and implement format conversion through a post-receipt process; this is called “consolidation.” If you don’t convert either before or after the transfer, you will be storing raw log messages.

Log message mining

The most efficient way for a log scanner to apply processes to a common pool of information is to convert all logs into one format before they reach the scanner. There isn’t a standard industry approach to the task of standardizing messages. So, the exact strategy that you need to deploy depends on the performance or security monitoring tool that you choose. 

If you receive log messages through a Syslog server, they will be written either to files or to a database in the Syslog format. Some monitoring systems use their own proprietary log message formats. In these cases, the tool will include its own log server and log manager because the producers of those packages can’t expect every software creator in the world to switch to their required message layout. 

The lack of an industry-wide standard for handling log messages presents a problem because you might want to use a security monitor that has its own message format, a performance monitor that uses the Syslog format, and an activity monitor that uses the Eventlog format. You could end up creating three copies of every log message.

The best free Syslog servers

If you decide to opt for a Syslog collection strategy, you would probably be more interested in getting a Syslog server that is free to use. However, that tool wouldn’t be any good if it doesn’t work properly. So, this forms the key test for inclusion on our list. However, there are other considerations.

Our methodology for selecting free Syslog servers

We reviewed the market for Syslog servers and assessed those that are currently available for free with the following selection criteria:

• Adaptable log servers that can be set up to receive Syslog messages
• Syslog-only log servers
• Syslog servers that are run either on the cloud or on-premises
• Syslog servers for all operating systems
• Log servers that can store messages to files or to a database 
• Nice to have a log parser that can scan for key fields and enrich records with metadata
• A free tool and not a time-limited free trial
• A system that works effectively without using too much processor time or memory

With these selection criteria, we looked for a range of packages that suit all business sizes and sectors, and we made sure to find examples for each operating system or platform.

1. SolarWinds Kiwi Syslog Server Free Edition

SolarWinds Kiwi Syslog Server Free Edition is an on-premises package that runs on Windows Server. The tool presents a Web-based console, so you open it in any standard Web browser. This tool will only collect messages from five devices; if you have more you will have to upgrade to the paid edition.

Key features:

• Collects Syslog messages: Also receives SNMP traps
• Live tail display: Shows messages as they arrive
• Files messages: Rotates files by date

Why do we recommend it?

SolarWinds Kiwi Syslog Server Free Edition is a straightforward receiver of Syslog messages that you host yourself. The package includes a data viewer in which you can filter messages, reducing the display of messages as they arrive. The tool has a basic alerting mechanism that will send you a notification if message throughput escalates.

The Kiwi system lets you receive and file Syslog messages. It will notify you if the arrival rate suddenly jumps and it can also be set up to email you a summary of activity every day. Get messages filed by date, severity, or both.

Who is it recommended for?

This is a good choice for those who just want a Syslog server and aren’t interested in getting lots of other log analysis functions for free. While extra features for free can be appealing, they complicate your life if you don’t have the time to learn how to use a whole monitoring package.

Download the free tool from SolarWinds which is limited to five devices. If the free version of the tool is too restrictive, you can check out the paid version of the Kiwi Syslog Server that allows you to operate it on an unlimited number of devices, send email, run scripts, archive logs by device, forward to databse, use an event log, SNMP, or syslog and more. Start by downloading a 14-day free trial.

2. ManageEngine Event Log Analyzer (FREE EDITION)

ManageEngine Event Log Analyzer Free Edition is a good option for people looking for a Syslog server that has extra functions. The full edition of EventLog Analyzer provides a log manager and a SIEM tool. With the Free edition, you get just the log manager. All customers get a free trial of the paid edition, so you get to look at the extra functions that you might want to pay for.

Key Features:

• Log message server: Receive log messages from operating systems and software
• Syslog option: Filter messages so you only process Syslog messages
• Doesn’t control which messages are sent to it: You should choose to only send Syslog messages to the tool to make it a Syslog server.

Why do we recommend it?

ManageEngine Event Log Analyzer Free Edition provides just the log management functions of the EventLog Analyzer package. This is a good thing for those who just want a Syslog server because the full package is very big with many features. Use this tool to receive, view, and file Syslog messages.

If you have both Windows and Linux endpoints on your system, you have a choice of where to install this tool because it runs on either of those operating systems. Wherever you install it, this system will receive Syslog messages from any operating system or cloud platform. You can also get the service as a SaaS package on the cloud.

Who is it recommended for?

This package has a wide audience because it is offered as a cloud-based SaaS platform and for installation on Windows Server or Linux. So, it will appeal to those who have a specific operating system on site and also to those who don’t like to host the software that they use.

Access this service as a SaaS platform or download the software for Windows Server or Linux. ManageEngine offers a 30-day free trial of the full Eventlog Analyzer package. Your system will switch to the Free edition at the end of the trial if you choose not to buy. 

3. Paessler PRTG Network Monitor (FREE TRIAL)

Paessler PRTG Network Monitor is a monitoring package that covers networks, servers, software, websites, and cloud services. The package is very large and the buyer pays for an allowance of sensors. Those who only want to use 100 of the sensors in the pack never have to pay for the system.

Key features:

• Listens for incoming log messages: Set all of your Syslog generators to send to it
• Displays arriving messages: Shows a scrolling window or recent Syslog messages
• Calculates throughput metrics: Such as logs per hour per source or severity
• Searchable data viewer: Filter log messages in the console
• Files Syslog messages: Writes Syslog messages to file

Why do we recommend it?

Paessler PRTG gives you a free Syslog server that will receive Syslog only and file those messages. Once you have the messages in a file, you can decide how to process them further with another tool. However, once the messages are in files, this tool’s work is done. 

The full PRTG package offers a network discovery routine that documents all the devices that it encounters, writing a system inventory. It will also generate a network topology map. These functions are available to you in the free edition.

Who is it recommended for?

This package is a good option for businesses of all sizes. Small businesses get spare sensors that they can activate to monitor their systems. Larger companies will either pay for PRTG to get a full monitoring service or just use PRTG as a Syslog server if they already have a system monitoring package that they are happy with.

PRTG is a service that most businesses have to pay for as part of their PRTG network monitoring package. However, the free version offers of 100 sensors which is a great deal for people who don’t want a full system monitoring package but just want a Syslog server. Anyone can access the 30-day free trial and, in fact, downloading the free edition gives you the full package of all sensors for 30 days before it switches on the 100-sensor limit. So, have a go at using all of the monitoring features in the bundle. PRTG is available as a SaaS platform or for installation on Windows Server. The allowance of 100 sensors for free is only available with the on-premises version. Download the 30-day free trial.

4. Logstash

Logstash is part of the Elastic Stack, which is also known as ELK. The package is a log server and it partners with Elasticsearch for data scanning and Kibana, which is a console. Those who want the full ELK package pay for the cloud-hosted version. However, a big secret is that you can get each element of the stack for free if you are happy to host it yourself.

Key features:

• Collect many log message formats: Including Syslog and Windows Events
• Files messages: Move the Syslog messages straight to file
• Log consolidation: Choose to receive multiple log formats and convert them to the Syslog format
• Convert to a different format: Transform Syslog messages to a custom format of your own design

Why do we recommend it?

Logstash is a flexible tool that can collect multiple log message formats and even receive data streams and convert them into a specific log message layout, such as Syslog. Use this tool to just collect Syslog messages and file them, or implement any type of conversion and forwarding that you can think of.

This tool is widely used and is particularly useful when used together with the other elements of the ELK suite. The Elastic Stack is so impressive that several companies have set up cloud services that just provide hosted ELK – you will encounter some of these later on our list. 

Who is it recommended for?

Logstash is very useful and its capabilities are much wider than just a Syslog server. However, it works very well for that function. You can even use Logstash to read CSV files and convert their record format or insert them into a database.  

Get each ELK component individually for free. Download Logstash onto Windows, macOS, or Linux. 

5. Loggly Lite

Loggly is a system monitor that uses logs as its data source and Loggly Lite is its free edition. You can use this tool to ingest and analyze logs from many sources, including from operating systems and software packages. Alternatively, you can just use the platform to receive Syslog messages and file them.

Key features:

• Collects logs from many different sources: You could just limit the tool’s scope to receive Syslog messages
• Analyzes log contents: Reads and processes the contents of the log messages
• Calculates activity metrics: Produces throughput counts 

Why do we recommend it?

Loggly is an extensive platform for log processing. It can be used as a system performance monitor or even as a security analyzer. You can receive logs in different formats and standardize them so that they can be stored and searched together. Alternatively, you can get the tool to read log messages and extract values from specific fields.

You can do many things with Loggly, but you don’t have to. You could just use it as a straightforward Syslog server that files messages and optionally shows them in the console as they arrive. It is also possible to set up alerts on the contents of logs or just the log throughput activity.

Who is it recommended for?

As this tool is so flexible, it is suitable for many different scenarios, including just receiving and filing Syslog messages. This is a SaaS platform, so you don’t need to worry whether you have the right operating system to host it.

Sign up for a 30-day free trial of the full version and then switch to the free Loggly Lite after that.

6. Logz.io Log Management Community Edition

Logz.io Log Management Community Edition is a free tool from the Logz.io cloud platform. This provider offers three services: Log Management, Infrastructure Monitoring, and Distributed Tracing. The Log Management service is available in three plans and the Community Edition is the simplest. 

Key features:

• Collect logs from many sources: Including Syslog
• Live log viewer: See messages in the console as they arrive
• File Syslog messages: Just file messages

Why do we recommend it?

Logz.io is similar to Loggly. You can use it to construct a full system monitoring service, creating that manually with the Log Management unit. Or sign up for the Infrastructure Monitoring package, which has all of the necessary data searches and visualizations set up for you. Use the Log Management plan to just collect Syslog messages if you want.

If you are not interested in anything more than setting up a Syslog server, that’s fine. Keep in mind that the Community Edition is limited to receiving 1 GB of data per day. That is a very generous allowance for a free tool and compares favorably to Loggly. This system is based on a fork of the ELK suite, called OpenSearch. 

Who is it recommended for?

Anyone can use this tool just as a Syslog server. The data retention period is only seven days, so make arrangements to move log files to another platform before they are deleted. This package provides compliance auditing for PCI, DSS, and HIPAA, but that’s not much use if the logs have been deleted before the auditor arrives.

Get a 14-day free trial of the Pro Edition and switch to the Community Edition when that runs out. 

7. Sematext Logs Basic Edition

Sematext Logs is a hosted implementation of the Elastic Stack. Sematext Logs Basic Edition is the free version that will give you a comprehensive log analysis tool or just a Syslog server. You can limit this free tool to whatever narrow purpose you choose or go all out and build your own system performance monitor. 

Key features:

• Collect logs from many sources: The system can be limited to Syslog
• File messages: Send messages to files as they arrive
• Sort and filter messages: Recall logs from files and analyze them

Why do we recommend it?

Sematext Logs gives you all of the ELK stack rather than just Logstash. The platform presents a log processor with an out-of-the-box dashboard, so you just need to point your applications to Sematext and then learn how to use the console. However, you can also customize the dashboard and teach it your system. 

The Sematext Logs Community Edition is a good introduction to the full service of Sematext Logs. Users of the free package will get more functionality than just a Syslog server but it offers a taster of how powerful log processing can be. Some users might hit the limitations of the free version and choose to upgrade to the paid service.

Who is it recommended for?

Sematext Logs Basic Edition competes with Logz.io Log Management Community Edition and Loggly Lite. All three are cloud-hosted systems and all present a prewritten log processing system that can be adapted. The data retention period for this plan is seven days and its throughput limit is 500 MB per day.

Try out the top plan, called the Pro edition, with a 14-day free trial. You can switch to the Community Edition when the trial ends.