LibreNMS is an autodiscovering PHP/MySQL-based network monitoring system forked from Observium. It aims to be easy to use and painless to deploy, and to support monitoring of a wide range of devices. Observium's license changed to a modified QPL license in May 2012, then was split into free and commercial versions. The aim of LibreNMS is to continue to create a usable NMS, but with a community focus and GPL licensing.
Cura is a mobile phone application bundle of remote server administration tools. It provides a personalized terminal emulator, a syslog module that allows for reading logs directly from a server, a SysMonitor module that visually graphs CPU and RAM usage percentages, access to Nmap, and Server Stats will offer general server information like its Vitals, Hardware information, Memory information, processes, and so on. A security feature allows you to have Cura's database wiped when you send the compromised phone a secret pattern of your choosing. (e.g. send an SMS message containing "phone has been stolen!" to your Android phone to wipe Cura's database and receive the location of the compromised phone as an SMS to your emergency phone number or as an e-mail to your emergency email address).
ida-syslog is a Web-based viewer for syslog data. It requires syslog data in a MySQL database. It uses AJAX and is based on jQuery and PHP. It is intended for use with rsyslog-mysql, but can be adapted to any table format via the config file. It has a fast UI with no page reloads, and can save search settings as templates for easy reuse. Tail mode and auto-loading of older entries when scrolling down. Fixes for use with Windows-Syslog-Tools (NTSyslog2, Snare).
LILA is a command line tool that allows you to monitor netfilter logs stored in a MySQL database in real time. It converts the text messages created by netfilter into nice colored output. Two features that should be highlighted are that it resolves IP addresses to hostnames with two different techniques and detects duplicate packets (with the same destination IP and chain) that have been sent in a freely configurable time interval. This allow the user to avoid getting flooded with hundreds of identical packets that don't offer any additional information. It uses a separate configuration file, which allows you to modify various aspects on how it works and how logs are being displayed. It has a lot of other features.
Graylog2 is an syslog implementation that stores logs in MongoDB. Messages are accepted via TCP or UDP. A Web interface allows you to view the log messages. It also implements GELF, the Graylog Extended Log Format, which is a simple JSON string that allows you to send long and structured syslog messages, which is very useful for customized application log monitoring.
Sagan can alert you when events are occurring in your syslogs that need your attention right away. It can store events into a Snort database, so your IDS/IPS data and log data are in the same place. This enables a single console, like Snorby or BASE, to view not only your IDS/IPS data but your log (syslog, SNMP, etc.) data as well. Sagan will correlate the data for you. It also uses 'Snort-like' rule sets, which means it is compatible with Snort rule set management software. It supports multiple output formats that any network administrator will find useful. Sagan can also stop threats based on log analysis via "Snortsam". This allows Sagan to communicate with various types of network devices (Cisco routers/ASA/etc., Linux iptables, etc).
libsyslogp is a library for parsing raw syslog messages. It currently supports RFC 3164 style BSD syslog messages (and some minor variants), and has limited support for newer RFC 5424 style syslog messages. This library has been written because there seem to be no independent C libraries for parsing raw syslog messages. The most complicated part of the task is to parse the date, which comes in a variety of formats; the source code for the built-in message parser of syslog-ng proved to be an invaluable reference for this. Nevertheless, the implementation here is independent of syslog-ng.