INTERACTIVE DEMO · SAMPLE DATA
This is the SyslogWatch window with a sample stream loaded — the same layout and the same stylesheet as the installed app. Seven devices are sending; an uplink failure and an SSH brute-force landed in the same few minutes. The severity chips and the search box work — switch off Debug and Informational and watch the noise go. Nothing to install, and nothing here is saved anywhere.
Click a severity chip to include or exclude that level. Colour is doing the work here: Critical and Alert are visible without reading a single word.
Read the top of the table downward and the outage assembles itself: the link drops, the line protocol follows, OSPF loses the neighbour, spanning tree reconverges, the access points fall off. Severity colour is what makes that readable at a glance instead of a wall of text.
It listens on port 1514 by default, over UDP and TCP, and accepts what your switches, firewalls, hypervisors and Linux boxes already send. There is nothing to install on them — you point them at your computer and they start arriving.
Messages are rolled to compressed archives on disk rather than dropped, and Search archived logs reaches back into them. Retention is a number you set, not a plan tier that quietly deletes your evidence.
Everything sending to you is received and stored on the free tier, from any number of hosts, with up to three alert rules. Pro adds full-text search across the archive, up to 50 rules, email notifications and CSV/JSON export. Enterprise adds the AI detection pass that flags patterns nobody wrote a rule for.
Every install starts with a 30-day trial of Enterprise — the AI detection pass included, no card, no account, no email address. Afterwards it keeps running on the free tier.