PlaybookSyslog software compared (features, cost model, best for)
safe intermediate #comparison#rsyslog#syslog-ng#graylog#wazuh#kiwi#fortianalyzer#splunk
When to use this: You want a side-by-side comparison of the common syslog servers and log platforms.
Cost information was gathered on 2026-11-13. Treat anything about price as a starting point and confirm on the vendor’s site.
| Software | Level | Runs on | Cost model | Best for | Watch out |
|---|---|---|---|---|---|
| rsyslog | 1 Store | Linux (default on Ubuntu) | Free, open source | Reliable collection to files, forwarding | No UI; searching is grep |
| syslog-ng (OSE) | 1 Store | Linux, macOS, others | Free open-source edition; commercial edition exists | Flexible routing and parsing | Config syntax to learn |
| Visual Syslog Server | 1 Store | Windows | Free | Windows admins who want a simple GUI viewer | Not built for large volume |
| Kiwi Syslog Server | 1 Store (with alerts) | Windows | Commercial licence (SolarWinds); get current price | Windows shops wanting a supported GUI product | Cost; Windows-only |
| Graylog Open | 2 Search | Linux (Docker or packages) | Free permanently per vendor; Enterprise and Security editions are paid, quote-based | Searchable dashboards for small and medium setups | Needs more RAM and a database stack |
| OpenSearch / Elastic stack | 2 Search | Linux | Free tiers and paid tiers; check each project’s licence | Large scale search, custom pipelines | More moving parts to run |
| FortiAnalyzer | 2 Search (Fortinet) | Appliance or VM | Commercial licence; reseller quote | Fortinet-centric reports and vendor support | Mainly for Fortinet logs; cost |
| Wazuh | 3 Security | Linux | Free, open source | Security detection and compliance on a budget | Heavier to size and tune |
| Splunk | 2 to 3 | Linux, Windows | Free tier with a daily volume limit; paid by volume (check current limit and price) | Enterprises with Splunk skills | Cost grows with volume |
| Cloud logging (CloudWatch, Azure Monitor, Sentinel) | 2 to 3 | Cloud | Pay per GB ingested and stored | Cloud-native estates | Costs scale with log volume; plan ingestion |
How to read the table
- If you only need to keep logs, rows at level 1 are enough and cost nothing.
- If you need to search, add a level 2 tool, or use FortiAnalyzer for Fortinet.
- If you need detection and alerts, move to level 3.
How to verify it worked
- You can name one option per level (store, search, security) and its cost model.
Q&A
rsyslog or syslog-ng?
Both are mature, free and capable. rsyslog ships with Ubuntu and most distros, so it is the path of least resistance. syslog-ng is popular for its readable config and macOS/Homebrew availability.
Is Graylog really free?
Graylog Open is free according to the vendor's pricing page (source-available SSPL licence). Paid Enterprise and Security editions exist with quote-based pricing. Check the current terms before committing.