Application log aggregation, management and notifications [closed]

Answer 1

For log aggregation, Snare is a little old but worth mentioning.

Snare Agent for IIS Servers

I used this old version a long time ago and it worked well by forwarding/sending/replicating IIS logs over a network via syslog.

Today, they have a newer version called Snare Epilog

The code is also open source; you might want to give it a try.

---

Also, you could use something like ELMAH combined with the RSS/Email features to help notify and alert you of any critical issues.

Answer 2

It depends on your needs. If, for example, you're running a data center and are mostly concerned with real-time alarming, then you might want to look at Avicode. It's very capable, but can be pricey.

If, on the other hand, you're supporting desktop applications or logs from remote systems, or are more concerned with offline log analysis then you might take a look at Gibraltar. It provides a nice combination of logging, log management and log aggregation/analysis capabilities. But, to be honest, I'm a bit partial -- I'm one of the Gibraltar developers.

Answer 3

In my case, I'm try to adopt scribe, facebook's log aggregator. Facebook and Twitter are using scribe now.

Answer 4

L4ndash: log4net log viewer with free developer version.

Answer 5

Check the Microsoft Log Parser and examples. The log parser can handle xml, csv as well as Microsoft event log, registry and can send information to 'syslog' servers.

From the example screenshot this seems to be really useful tool.

Answer 6

If you can, I'd recommend writing to the EventLog and creating rules in SCOM to monitor. We use this extensively and it works well, even to a point of putting together pieces of code which monitor certain elements of our apps and writing values to the event log, where SCOM parses for the errors, and graphs those, plus informational errors, into reports showing stats over a given time.

I am however quite keen on rewriting some that into WMI, and having SCOM poll the WMI service for those same counters, as writing queue lengths to event log every 15 minutes seems a little wasteful ;)