is there any free or open source tools that is able to collect audit logs from firewall in syslog format for monitoring purposes? There is 2 firewall in my organization and I would like to track changes done in the firewall by the administrator for compliance purposes.

Unfortunately there is budget constraints and we cannot afford to purchase SIEM solutions for this purpose.

Any tools or combination of tools that can achieve this objective is greatly welcomed.

closed as off-topic by Xander, TildalWave, Jens Erat, schroeder, Gilles Jan 25 '15 at 21:34

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.



Spunk would be perfect for this situation, it is free (if less that 500 mb of logs a day) and is easy to use.

download it here http://www.splunk.com/download

I hope this helps,


  • I use Splunk and it works very well for this. – schroeder Apr 27 '12 at 2:00
  • With the reporting and graphing features, it is easy to turn Splunk into an SEIM. – schroeder Apr 27 '12 at 2:01

rsyslog, syslog-ng and even the venerable syslogd will aggregate logs from multiple sources. Certainly splunk provides some nice functionality for mining the data, but there are lots of other free tools about - logwatch, awstats (not just for web servers!), ossec, Adiscon log analyzer

for compliance purposes

That's often a cover phrase for "I don't know why I'm doing this". In which case, I'd recommend spending some time thinking about what information you can possibly get from these logs. It will better enable you to pick the right products and implement them effectively.

  • 'compliance' in this case could simply mean they need to keep track of all changes using a system that the change agent cannot control, which an off-site log aggregator can do nicely. – schroeder Apr 27 '12 at 2:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.