Centralized logging for multiple servers

[Kon Wilms]

On Fri, Apr 17, 2009 at 5:07 PM, Gabriel Ramuglia <gabe at vtunnel.com> wrote:
> I was able to use the wayback machine to find the most recent pricing
> for splunk. It seems that 1gb / day license costs $10k and 10gb / day
> of log volume is going to set you back $30k. Above that and you have
> to ask them for pricing. That's really not going to work seeing as how
> I'm doing more like 100gb / day. Their current website doesn't have
> any prices at all and just asks that you contact their sales
> department.

The trick is to reduce your log volume. I use a number of parsers that
filter and summarize logs before pushing them to the central NMS
server and placing them into the splunk queue. Works perfectly and if
there is a need to analyze a specific problem we can always go back to
the machine with the source logs for further investigation.

Cheers
Kon