Open Source Linux Logging Software

Zabbix is an enterprise-class open source distributed monitoring solution designed to monitor and track performance and availability of network servers, devices and other IT resources. It supports distributed and WEB monitoring, auto-discovery, and more. An enterprise-class distributed monitoring solution for networks & apps

Ettercap is a multipurpose sniffer/interceptor/logger for switched LAN. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis. Development has been moved to GitHub, https://github.com/Ettercap/ettercap

This small tool allows the user to graphically examine ddrescue's mapfiles in a user friendly GUI application. The Main window displays a block grid with each block's color representing the block types it contains. Many people know this type of view from defragmentation programs. The program is written in Object Pascal using the Lazarus IDE. It can be compiled to run on Windows, GNU/Linux and probably OS X, too. The downloads include binaries for the respective target platform and the project files (source code). Update 2022/02/25: ddrescueview version 0.4.5 has been released. This maintenance release restores compatibility with ddrescue 1.24 and later. Please consider testing this version. Report issues in the bug tracker if you have a sourceforge account, or by email to <mbit-kiel@users.sourceforge.net>

tcpick is a textmode sniffer; it tracks tcp streams, shows the status, reassembles and saves the data captured in files or displays them in the terminal in different modes (ascii, hex..). There is a color-mode. Useful to get files passively.

Hyperic is application monitoring and performance management for virtual, physical, and cloud infrastructures. Auto-discover resources of 75+ technologies, including vSphere, and collect availability, performance, utilization, and throughput metrics.

OpenXDAS is an open source implementation of the Open Group's Distributed Auditing Service (XDAS) specification. OpenXDAS provides a complete implementation of the XDAS specification API, including client-side instrumentation and filtering.

A C++ diagnostic logging API that is simple to use, 100% type-safe, generic, infinitely-extensible, atomic, platform-independent, and extremely efficient. And, best of all, it upholds the spirit of C: you only pay for what you use.

xrootconsole tails a file in a window on your X11 root window. It aims to be as simple and resource-light as possible, within reason: it should run smootlhy on a P133 laptop. The program is non-interactive; all configuration is done on the command line.

LKL is a userspace keylogger that runs under Linux on the x86 arch. LKL logs everything that passes through the hardware keyboard port (0x60). It translates keycodes to ASCII with a keymap file.

Output spool reader for Snort! This program decouples output overhead from the Snort network intrusion detection system and allows Snort to run at full speed. It takes input and output plugins and can therefore be used to convert almost any spooled fil

A bandwidth meter, for monitoring internet connection speeds and usage.

This is a set of perl and php scripts that are used to collect, process, store and display netflow data.

This project involves adding code to the Linux kernel to implement crash dumps for performing post-failure analysis of a kernel crash.

A complete OpenSource Network Management System Is SNMP-Standard Oriented (tested on Cisco and Linux). It Integrates Syslog, Tacacs, RRDtool (Performance Graphs), Maps, Traps, TFTP, Autodiscovery, Sound Alerts, AAA, Modular and Extensible.

360-FAAR (Firewall Analysis Audit and Repair) is an offline, command line, firewall policy manipulation tool to filter, compare to logs, merge, translate and output firewall commands for new policies, in Checkpoint dbedit, Cisco ASA or ScreenOS commands, and its one file! Read Policy and Logs for: Checkpoint FW1 (in odumper.csv / logexport format), Netscreen ScreenOS (in get config / syslog format), Cisco ASA (show run / syslog format), 360-FAAR compares firewall policies and uses CIDR and text filters to split rulebases / policies into target sections and identify connectivity for further analysis. 360-FAAR supports, policy to log association, object translation, rulebase reordering and simplification, rule moves and duplicate matching automatically. Allowing you to move rules to where you need them. Build new rulebases from scratch with a single 'any' rule and log files, with the 'res' and 'name' options. Switch into DROPS mode to analyse drop log entries.

Show system and ISDN information on external liquid crystal displays

CTrace is a multi-threaded trace debug library written in C. It provides a simple, fast, well documented trace utility for applications and as such is especially suitable for use in real-time embedded applications.

Lire is a pluggable log analyzer, supporting HTTP, email, DNS, FTP, firewall and print services. Output generated can be txt, (X)HTML, PDF, RTF, and DocBook. The latter four support graphics. For news/support visit the project homepage.

Fail2Ban monitors log files like /var/log/pwdfail or /var/log/apache/error_log and bans failure-prone addresses. It updates firewall rules to reject the IP address or executes user defined commands. Please see code and download from https://github.com/fail2ban/fail2ban . SF Fail2ban portal might not be up-to-date

Provides an open-source, platform-independent Event Logging facility for the Linux Operating system and Linux applications, that offers capabilities and features required in medium-to-large Enterprise-class systems.

MonPoly is a prototype monitoring tool that checks compliance of log files with respect to policies specified by formulas in MFOTL (Metric First-Order Temporal Logic). An overview of the tool, including its usage and history, can be found under the Files tab: https://sourceforge.net/projects/monpoly/files/monpoly.pdf/download. The tool is developed as part of an academic project at ETH Zurich. Please visit the following link for more details on the project: http://www.infsec.ethz.ch/research/projects/mon_enf. The development repository has moved to https://bitbucket.org/monpoly/monpoly.

A tool to monitor internet hosts` bandwidth usage in a Linux-NAT network. A daemon collects data and clients display them (currently a Java applet with a graph). It automatically detects new hosts and has a nice summary statistic.

Automated Security Tools (autosec) aims to provide automatic tools which network administrators may use to help check and test the security of their network.

IP accounting tools package based on Berkeley Packet Filer mechanism. Continue from BPFT by V.Vorobyev, TRAFD by V.Belekhov & S.Svirid. Use the PCAP library to implement connection to bpf kernel pseudo-device.

Big Sister is an SNMP aware network and system monitor