Observium is an autodiscovering network monitoring system focused primarily on Cisco and Linux networks but includes support for a wide range of network hardware and operating systems. Observium has grown out of a lack of easy to use NMSes. It is intended to provide a more navigable interface to the health and performance of your network. Its design goals include collecting as much historical data about devices as possible, being completely autodiscovered with little or no manual intervention, and having a very intuitive interface.
Syslog4j provides Java components for client and server implementations of the syslog protocol (RFC 3164). UDP/IP, TCP/IP, TCP/IP over SSL/TLS, Unix Syslog, and Unix Socket Logging are supported. Advanced options are provided, including cryptographic message signatures and hashes. It is heavily tested with JUnit and Emma code coverage.
libsyslogp is a library for parsing raw syslog messages. It currently supports RFC 3164 style BSD syslog messages (and some minor variants), and has limited support for newer RFC 5424 style syslog messages. This library has been written because there seem to be no independent C libraries for parsing raw syslog messages. The most complicated part of the task is to parse the date, which comes in a variety of formats; the source code for the built-in message parser of syslog-ng proved to be an invaluable reference for this. Nevertheless, the implementation here is independent of syslog-ng.
Sagan can alert you when events are occurring in your syslogs that need your attention right away. It can store events into a Snort database, so your IDS/IPS data and log data are in the same place. This enables a single console, like Snorby or BASE, to view not only your IDS/IPS data but your log (syslog, SNMP, etc.) data as well. Sagan will correlate the data for you. It also uses 'Snort-like' rule sets, which means it is compatible with Snort rule set management software. It supports multiple output formats that any network administrator will find useful. Sagan can also stop threats based on log analysis via "Snortsam". This allows Sagan to communicate with various types of network devices (Cisco routers/ASA/etc., Linux iptables, etc).
Graylog2 is an syslog implementation that stores logs in MongoDB. Messages are accepted via TCP or UDP. A Web interface allows you to view the log messages. It also implements GELF, the Graylog Extended Log Format, which is a simple JSON string that allows you to send long and structured syslog messages, which is very useful for customized application log monitoring.
LILA is a command line tool that allows you to monitor netfilter logs stored in a MySQL database in real time. It converts the text messages created by netfilter into nice colored output. Two features that should be highlighted are that it resolves IP addresses to hostnames with two different techniques and detects duplicate packets (with the same destination IP and chain) that have been sent in a freely configurable time interval. This allow the user to avoid getting flooded with hundreds of identical packets that don't offer any additional information. It uses a separate configuration file, which allows you to modify various aspects on how it works and how logs are being displayed. It has a lot of other features.
ida-syslog is a Web-based viewer for syslog data. It requires syslog data in a MySQL database. It uses AJAX and is based on jQuery and PHP. It is intended for use with rsyslog-mysql, but can be adapted to any table format via the config file. It has a fast UI with no page reloads, and can save search settings as templates for easy reuse. Tail mode and auto-loading of older entries when scrolling down. Fixes for use with Windows-Syslog-Tools (NTSyslog2, Snare).